cycbot | 2b9f6fa900c4270da970a4fd2c6f9a9a44b9d7f1d24b673f8e45fb53a36a461b

General

Target

JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe
Size

177KB
MD5

4308be7ca53eaeb21e61bb1f087951b3
SHA1

a0ad592c2099ae4b1ae73f00a3f8a0ca8094ae90
SHA256

2b9f6fa900c4270da970a4fd2c6f9a9a44b9d7f1d24b673f8e45fb53a36a461b
SHA512

8e5bc86b1916b7f1f5bca12411c6d863ea543d70d219b7e9ce7881c28ca3332e3517fb0911d0c7602215d8509b621fefbdafa5104a61219fb580658fb96622bc
SSDEEP

3072:kVATXvSDuU9v1/7Dr59+l/Yj1gYQQvlmBcjb3+NkgNH+k6c3MckyYKrqn:kVAeCM9n59+pYjhtIBcjb3+KgNLRMckd

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4548-14-0x0000000000400000-0x0000000000456000-memory.dmp	family_cycbot
behavioral2/memory/440-15-0x0000000000400000-0x0000000000453000-memory.dmp	family_cycbot
behavioral2/memory/440-16-0x0000000000400000-0x0000000000456000-memory.dmp	family_cycbot
behavioral2/memory/4924-80-0x0000000000400000-0x0000000000456000-memory.dmp	family_cycbot
behavioral2/memory/440-183-0x0000000000400000-0x0000000000456000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/440-2-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/4548-12-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/4548-14-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/440-15-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/440-16-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/4924-78-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/4924-80-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/440-183-0x0000000000400000-0x0000000000456000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4548	440	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe	82
PID 440 wrote to memory of 4548	440	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe	82
PID 440 wrote to memory of 4548	440	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe	82
PID 440 wrote to memory of 4924	440	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe	88
PID 440 wrote to memory of 4924	440	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe	88
PID 440 wrote to memory of 4924	440	JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:440
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe startC:\Program Files (x86)\LP\0595\000.exe%C:\Program Files (x86)\LP\0595
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4308be7ca53eaeb21e61bb1f087951b3.exe startC:\Users\Admin\AppData\Roaming\51EE2\77105.exe%C:\Users\Admin\AppData\Roaming\51EE2
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\51EE2\2929.1EE

Filesize
1KB

MD5
325318d8f894300bb10de76f98376843

SHA1
a2ce98d2193751d6404266dac316d7a2aaadac3d

SHA256
7578913238a8409611299dee92fbe6e31f9a9d3cfc61c1bb901254caed48cfa8

SHA512
45fc806a5bd2932c5365c515cdb84b4a7ad0c3bc58de12ee9cb70bd2c72fa6965e3da74e3b7d9d11a453741551b1fbb844e0d6b98ae3a35b75c4bc8b60551fcd

Download Submit
C:\Users\Admin\AppData\Roaming\51EE2\2929.1EE

Filesize
600B

MD5
f684cc0bba6a2a217fdb99647a03c1af

SHA1
3ca31650ef71035ec613363d0e3643c0880e000d

SHA256
e1d72ad30322cfc6b75f3fe7391f96c400054735f75822e78a14ca437095272b

SHA512
6ce4d0ab933ac43a0716706a0162ba316838e3ddc20c6a14a9cfb28e8ddfe4914fb5d05b4a683082cb0569b3a39e8edfa7557c17b2b67cc8367f99ba7dd40c7c

Download Submit
C:\Users\Admin\AppData\Roaming\51EE2\2929.1EE

Filesize
996B

MD5
cd1906ed8e89a531932753c0ccb3ab9e

SHA1
d51428b7d154c814402098e688d5a7d0a4e819d8

SHA256
d99da9565c26513424d1a6f04af2cefb1d007961ec2008a79c3fa5e2deb3f2d0

SHA512
a7b25477e22b102ce6fa3c0229fd8d401646576ab8de0aed6da38832055c4abeed81d508e55b9d025759123f8862949e9dd5c52512f6d31e6ea35a33ee004ab4

Download Submit
memory/440-2-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/440-183-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/440-1-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/440-15-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/440-16-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4548-12-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4548-14-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4548-11-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4924-80-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4924-78-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing