cycbot | 107611f23a6364bdd7907954eaa67976adf854619801964629e9b8fd8cb4b7f6

General

Target

JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe
Size

183KB
MD5

3c5e6b8c4a5475493f413a38195605d0
SHA1

cc04807c74e12f9851bdaddbe0042f8f7e789a2d
SHA256

107611f23a6364bdd7907954eaa67976adf854619801964629e9b8fd8cb4b7f6
SHA512

06f861305217ae5402eaede9da85a8e627e48e9b46b8f28ebbdbc53460a617812184fd4317c0045271bb76847ec84bd7769f2e4343ef70f2394d4d25eac1146b
SSDEEP

3072:wFldeCh7i/0ZXZkedhBIq8ahT1lQjG63PPjZMDmxRJ63Mk:wE+7i8ZXZkwaqbh1lcl3O6xT9

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4936-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/2404-15-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/2404-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/5096-130-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/2404-297-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2404-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4936-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4936-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2404-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2404-16-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/5096-130-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2404-297-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 4936	2404	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe	82
PID 2404 wrote to memory of 4936	2404	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe	82
PID 2404 wrote to memory of 4936	2404	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe	82
PID 2404 wrote to memory of 5096	2404	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe	87
PID 2404 wrote to memory of 5096	2404	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe	87
PID 2404 wrote to memory of 5096	2404	JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe startC:\Program Files (x86)\LP\6D3C\35B.exe%C:\Program Files (x86)\LP\6D3C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c5e6b8c4a5475493f413a38195605d0.exe startC:\Users\Admin\AppData\Roaming\CC25B\FAC6D.exe%C:\Users\Admin\AppData\Roaming\CC25B
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CC25B\B45A.C25

Filesize
300B

MD5
ae5dd81b4776a1df6fc5fa20e72e6b62

SHA1
8c727410ec5399424aaf13439443108fd81ee924

SHA256
d024cac1df4783d7bc3b35cbed1140ac8730cb7b4c9e98fca699ebb6facf55a0

SHA512
3c3b61a8b481bb4286a1773cd345a08ea65c3fec2474394ae62d840504fba28941641aa909120781dd2797dbdf1c3b7df428e8c1a0abedfb2008f41d285e4f14

Download Submit
C:\Users\Admin\AppData\Roaming\CC25B\B45A.C25

Filesize
996B

MD5
10f8c15f616472811ba4db2b1af888be

SHA1
0e9846c142b593f7a9e26fdefde163bd67cc3bb3

SHA256
85901781be0b49f5c02994393e185ad7349b44ca916d203f24bb2744b36011a7

SHA512
15ba44aac649c8042ce11fb13501806d70a4d947cbe20ff96d7acebd3bf6b088669335b38694da080dbfce3d6776c277c7b80d86a6ce0956acc216256ecbacda

Download Submit
C:\Users\Admin\AppData\Roaming\CC25B\B45A.C25

Filesize
600B

MD5
6838bfff600bf21228fc1895395bd5f3

SHA1
8978d1ed4926e7a665b6355cfa4518bba4095f73

SHA256
b3738685773d075cdbcc9f293457497f82463b9e43f32666ac3a39b6bba7deb3

SHA512
996f73859a32a6129abbbb0508504e6189beeb8c54abc651016f8307695ce39656212c20ad2ff3f0645d34b1ba153417ef0f532dbe70edc6714638d48b647830

Download Submit
C:\Users\Admin\AppData\Roaming\CC25B\B45A.C25

Filesize
1KB

MD5
456252032d42b11d22e321b7fca92171

SHA1
2b863d9682dfa4d420a0964206f99d89ccb64c54

SHA256
97f39f75d185e6c468a8e0b0fa4aef6d876815c52670003dcf2ac18411d59636

SHA512
fe99f6dc038ed24673deffd256ac4abae902e8595fc3b8ed003cf5b5ce7325d1847a89d35c25c8758a47f635d88071986368fbacff6fc64698ba2ed18e40ce0a

Download Submit
memory/2404-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2404-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2404-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2404-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2404-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2404-297-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4936-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4936-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5096-130-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing