cycbot | 4ba7c00f964753f270ba73ff1efa1570c2fac277f22ec1a68627a6b06483ba32

General

Target

JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe
Size

189KB
MD5

42ffa5d96e0673b674aa73622207710c
SHA1

08102975945c0a8ff848128cf7fe5ead6f0fddf1
SHA256

4ba7c00f964753f270ba73ff1efa1570c2fac277f22ec1a68627a6b06483ba32
SHA512

c4b868288acf103cad775ca8df570396fa3146e63548309a3273ea6e8cfdb64309ce4a0f8ff0bcccba0a9ac758303a668bca77dc8e58e59845d143ab2d196e3b
SSDEEP

3072:8i6AJt1Sw6M9E1siYUIqP6uhvHt6kmlB9/n/RUzOKaWg4En2mAAKy31lhrmAM2Ps:lluwh9rPqCuV4HP2zOKJmsy31rrmIkE6

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2948-8-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/2496-15-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/1536-82-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/2496-166-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/2496-201-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2496-2-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2948-6-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2948-8-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2496-15-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/1536-80-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/1536-82-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2496-166-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2496-201-0x0000000000400000-0x000000000044D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2948	2496	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe	30
PID 2496 wrote to memory of 2948	2496	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe	30
PID 2496 wrote to memory of 2948	2496	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe	30
PID 2496 wrote to memory of 2948	2496	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe	30
PID 2496 wrote to memory of 1536	2496	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe	32
PID 2496 wrote to memory of 1536	2496	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe	32
PID 2496 wrote to memory of 1536	2496	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe	32
PID 2496 wrote to memory of 1536	2496	JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42ffa5d96e0673b674aa73622207710c.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\37EA.F11

Filesize
1KB

MD5
3ec8a01e044507a356c94e1982c80637

SHA1
82fc12e343bba22d01c9066852c1b789a7c06279

SHA256
80ba626ad1efe48d42d38b5845d636b19f16766add20ff18834fa71a7bb59fed

SHA512
af884e9510e8fda024d23a31be0ba0645c6c5133002f544a7f1d42d279755157916675be23a329a3678198c9914d4d283833923291fb31d7c393b4783780b02f

Download Submit
C:\Users\Admin\AppData\Roaming\37EA.F11

Filesize
600B

MD5
2b5da3b5a5b59a0a5ef7817d45502352

SHA1
c544a09be5d43454101242afa0768d65f9c8b4f3

SHA256
d9318999a109283203842333763a9e789416d65a1882333176a12430b03197dc

SHA512
7c660be327c12267698e0ff80c89cc1b5249f2a7d775841ab1c8080afec8424561ef1830219be5d221a536d8fdd8986f2ed32e288ccc53189ce205dd3cd658b9

Download Submit
C:\Users\Admin\AppData\Roaming\37EA.F11

Filesize
900B

MD5
ae06e1f7834c83f2b1e0672be0eaf9da

SHA1
5f2a4cda1939a55bf5915932dc32eaa4890ae985

SHA256
e79a7eb05622bd16dd4f4d33d2be1f4847fb0ea93a4b9c5fe64a9b35c102edc8

SHA512
ccc9b14f1a7a9a322116544d007a047c944c223980f475526316f41ee603df05149f679b35128831d9fd57efef3f49b159def10610647eb93b701ee1c12828a7

Download Submit
C:\Users\Admin\AppData\Roaming\37EA.F11

Filesize
1KB

MD5
6749902096d96a3c799cdd873ba13114

SHA1
2b5f61f8c54d92f57db681480e6c4bfcdcba0e0a

SHA256
9582d7489f68cabed1591c5b5c5d0a07fceafd70ebdc0a8c60332fd8b129e463

SHA512
a49255fb29fa1c6bb72d743ae70ce09539d772d4fd0a26910ca59ef4125a77c520c2d460e4b062005458bf9a76ad9a835348b26b1964302138da8fa3bfd35b16

Download Submit
memory/1536-82-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1536-80-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2496-15-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2496-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2496-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2496-166-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2496-201-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2948-8-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2948-6-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2948-5-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing