cycbot | 4f26d28c38981433cc7924b6f28ec9b5c323a4cdeba2bd484b15a957d3040593

General

Target

JaffaCakes118_321d44e881d7468acc3af325674139cc.exe
Size

164KB
MD5

321d44e881d7468acc3af325674139cc
SHA1

52906492521a8c26a994e7e3980ad5714b423199
SHA256

4f26d28c38981433cc7924b6f28ec9b5c323a4cdeba2bd484b15a957d3040593
SHA512

d6dc0d6a8e82ab6416acad0fb99d5b6b2ed8ba9ca5dc929521ea26823d8f0df173f4ebd6a227091d835e6de230957b3fdc0fa5731db131f0c096be1a891b8bb6
SSDEEP

3072:OpVE+vos9pDVbz1ij/SgdqesZvpYhzlELMzHcXuGwBoyBJ:GCmos95XiGoqFZvpupELMzTGvy

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1420-8-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral1/memory/2040-16-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral1/memory/1280-86-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral1/memory/2040-200-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2040-2-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/1420-6-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/1420-5-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/1420-8-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2040-16-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/1280-85-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/1280-86-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2040-200-0x0000000000400000-0x0000000000468000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1420	2040	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe	30
PID 2040 wrote to memory of 1420	2040	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe	30
PID 2040 wrote to memory of 1420	2040	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe	30
PID 2040 wrote to memory of 1420	2040	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe	30
PID 2040 wrote to memory of 1280	2040	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe	33
PID 2040 wrote to memory of 1280	2040	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe	33
PID 2040 wrote to memory of 1280	2040	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe	33
PID 2040 wrote to memory of 1280	2040	JaffaCakes118_321d44e881d7468acc3af325674139cc.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_321d44e881d7468acc3af325674139cc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_321d44e881d7468acc3af325674139cc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_321d44e881d7468acc3af325674139cc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_321d44e881d7468acc3af325674139cc.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_321d44e881d7468acc3af325674139cc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_321d44e881d7468acc3af325674139cc.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\11CF.7FD

Filesize
1KB

MD5
e89a2e7fb1534e9a35b2c6c818d8aea1

SHA1
82582e48b11e8b94759f384599b0e45cd76cd0a9

SHA256
f37234f65ba39ca1a35ec44b9dfc288278495c1358682b67ecc27e4725fc9b89

SHA512
bf75fd8bf0a92f29faafc83cabf87fb48f2e9d9ff2388fc24436b8e7007bf6d4426990b9081031302ca3e4d929bf9c3078c7933535cbb543cefd242bf73a984a

Download Submit
C:\Users\Admin\AppData\Roaming\11CF.7FD

Filesize
600B

MD5
826c8522568505f4decd4b7ce955c741

SHA1
15a5d7cf3b1c84481aed822db3c699f7428ecc2a

SHA256
99d8072c8b701a6cd8f5e11d6621fd97eb374756863d51622fd44662c7e4d0b5

SHA512
ee33573fcd665d44f377349fa58973a94e62708ead96db7d3eab836b508634e8859722804d55c307762ce1c730ea7907316c9b8f5e29edcef0992b4699797fe6

Download Submit
C:\Users\Admin\AppData\Roaming\11CF.7FD

Filesize
996B

MD5
6d64887ff69accccf8304686b5fdea27

SHA1
321c91f44c546404b910bf20ed0d9e2ff5275ea4

SHA256
3165762028ecab3a8e6d024e23b4d96613e57ada78f0d1c0feab35eb79fba1ce

SHA512
e0e5b4eebb7df9e6789b0d1d4c84ede49a3a3aba69044722a1b1c05834b392b8aa5a90c258a20fc48a8eafa0f0c34309b8e3d168d387659e2b6c3b10e2891f3d

Download Submit
memory/1280-85-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1280-86-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1420-6-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1420-5-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1420-8-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2040-2-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2040-1-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2040-16-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2040-200-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing