cycbot | 9dadaed7f04e8e87c74ee735a7ae3e2d8712483debc591c35ac6076a91b76fc9

General

Target

JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe
Size

183KB
MD5

423bf5a37f84d1b980669ac84208a279
SHA1

4650f8b6d1f914f6dc05332710d6bac3943f21fc
SHA256

9dadaed7f04e8e87c74ee735a7ae3e2d8712483debc591c35ac6076a91b76fc9
SHA512

ac7133bd4f07521db7ccf131cbd54fb4c2d7bf4ebcc0e2e7babc789df1584fb384951653ef72b63a6a6e94e64dd678ec5d7abcbac08d5dafa35b8fd6c33471f2
SSDEEP

3072:rMa2Q1d2BRrvzQLt4wT0l8bNRmshrzezmUsHjPoGLJxTEeCsYyWXyfisyY49j6lQ:rgQaRoLt4W+8Jrqz9QjwaTEeJBiUoSQ

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1800-6-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2508-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2508-74-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2976-77-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1800-5-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1800-6-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2508-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2508-74-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2976-76-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2976-77-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1800	2508	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe	30
PID 2508 wrote to memory of 1800	2508	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe	30
PID 2508 wrote to memory of 1800	2508	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe	30
PID 2508 wrote to memory of 1800	2508	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe	30
PID 2508 wrote to memory of 2976	2508	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe	33
PID 2508 wrote to memory of 2976	2508	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe	33
PID 2508 wrote to memory of 2976	2508	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe	33
PID 2508 wrote to memory of 2976	2508	JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423bf5a37f84d1b980669ac84208a279.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C817.2B8

Filesize
300B

MD5
987c35eb114609bbda493d9277a3723f

SHA1
83648094951dc0a1703dd638e2296b2eedb953d0

SHA256
845f03468503bfb7c2e95ea61857ff0fa1ff0b863d179524f73e415f2a75a942

SHA512
9bb85585823012eaeeed8bc8c28708420fbbe8abd6f061e70133a5d86659d6e971885b2a52d689c2fde59045f72109e9f6eb0c9cec9d50775a177c456180eb74

Download Submit
C:\Users\Admin\AppData\Roaming\C817.2B8

Filesize
1KB

MD5
7de541632bfdd783306c9c278b76d256

SHA1
be2464d4d2500181e0bc2f53d0cf1f1b4d459275

SHA256
033d33a5b0529ad2835c7c8c2a6805505be9c9cd60414e2d3336fee9ad1c91f3

SHA512
e8a29af0bc0260c6267eff432b294b161da6fd49d07661984259f0c7be723dfadbae6557fb8fa20b1f2f241e5adce20cbeb7a5f8f6463b9b02a1b205756c17ca

Download Submit
C:\Users\Admin\AppData\Roaming\C817.2B8

Filesize
600B

MD5
955949d8c1096f929e92b05c38838794

SHA1
720b2d752fedc60fa4286ca9fbb948630305a983

SHA256
cdc551b94808a166fd02828be2dd8674798d8c24aca933e67ab57138d69efff8

SHA512
dd41c60cc9cf4920c35d765927f30863d9807424024a4677f17faa84b4dd227903f54db5f0200d443fb58b67ec6571cfd30436fea90ec65328ce8c7b30594659

Download Submit
memory/1800-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1800-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-74-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2976-76-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2976-77-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing