cycbot | 113e4bc5259272347a7aa39e0a172317f01a14814c3359cbeddc144e7f16a236

General

Target

JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe
Size

187KB
MD5

439fa8e7368ee82bacc8e9dfb93153ce
SHA1

bf95486af9518ae3c207f1bcb7c2be2c02ffe54f
SHA256

113e4bc5259272347a7aa39e0a172317f01a14814c3359cbeddc144e7f16a236
SHA512

504aac164a6127a3a0df92f67f2247bcf3bf6f3f985e6e53061a93de8131e356cd091f29a145d101760623903750c39c3e44569b0b734c8a9353b037ce9c89d5
SSDEEP

3072:EiEwWW0AYX9dbOKLCNh072GeTm9sZuKp2nPSqgPXWL+T5hC:EiE97diKeCa52Cth

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4760-13-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3908-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3908-15-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/3532-128-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3908-271-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3908-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4760-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3908-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3908-15-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/3532-128-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3908-271-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4760	3908	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe	86
PID 3908 wrote to memory of 4760	3908	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe	86
PID 3908 wrote to memory of 4760	3908	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe	86
PID 3908 wrote to memory of 3532	3908	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe	99
PID 3908 wrote to memory of 3532	3908	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe	99
PID 3908 wrote to memory of 3532	3908	JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe	99

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe startC:\Program Files (x86)\LP\1B16\D85.exe%C:\Program Files (x86)\LP\1B16
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439fa8e7368ee82bacc8e9dfb93153ce.exe startC:\Users\Admin\AppData\Roaming\6B7A3\6C81B.exe%C:\Users\Admin\AppData\Roaming\6B7A3
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6B7A3\31C7.B7A

Filesize
996B

MD5
5f079379d1df5774b82b9e7e2fad6203

SHA1
c6b79a5e35da2bf53e307218247fa8a7ee6698b8

SHA256
20d647f74bdaa58f329de8b0220a916cb597980c95284a12da7fbb9f081da16e

SHA512
e96f9dfa8341dc99726edfa4c4e45e09e7173dbcd121a468e2838160a80c71c94ccf450c3db97db9f03f3b166c7c8e9b62ef5d526421b455b730e748761005e4

Download Submit
C:\Users\Admin\AppData\Roaming\6B7A3\31C7.B7A

Filesize
600B

MD5
d3272f956c8fe3ea791ef2b9bd22024b

SHA1
d00cb9954c681f780f6aa33003ae3dfd061857fe

SHA256
13fffe857ace3d00bcad9a8333caff5a8bb57a330993f526785a5f0f2e22bb4b

SHA512
56d20f32b40f16858b5565dde4ccf97ac70c86d94b748676205838f577069645f766b4129d7088d02f8f571941fe3937cf8151a2af2ce5524c1033da6dee93dc

Download Submit
C:\Users\Admin\AppData\Roaming\6B7A3\31C7.B7A

Filesize
1KB

MD5
6529229c67abfd9606e81bd0e4928178

SHA1
4b334fbba939fee9b2007bc3a93374bd7873e1a6

SHA256
7ad282cf599244d4bf1ffd2e3f57ff85c486975c7ff32d42fe3ff586c0d0e9f0

SHA512
3a4e469f9a4a10a28bdc4c2f64efe807a88fbfd9dbdee8c025b3a7fb416cec6f54d422ac1255324bf430624791fe2d55d8480f1500d7fe16ba21b06f1c635d51

Download Submit
memory/3532-128-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3908-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3908-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3908-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3908-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3908-271-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4760-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4760-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing