cycbot | 13b5f15799beedb19ebbaebda1e2907f3736be18d2f8f328ffbe3f4ea056450b

General

Target

JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe
Size

185KB
MD5

44cc3c802fd02f134929bc18c79c5b54
SHA1

4b02948c1f2ef73a71aa7212649b8aa4a50cf0b3
SHA256

13b5f15799beedb19ebbaebda1e2907f3736be18d2f8f328ffbe3f4ea056450b
SHA512

baf9cc73843d92070ec0e191714cd12ba26318b1e59f81eb09063c6bbd907ed254aaf1d5265b8ac1fc219d7936fa94bea1b894b5add2c2c40d641729d50224d6
SSDEEP

3072:pGSyJii04Cjd9nRARiyiHBLilOPAys0CXAORDQNA8RISOJ4OyDeMhCtZ18/fLe0p:pGSti04GR6iL4byLtOsQSEDySMKZ18bx

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2028-13-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1364-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1364-15-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/3876-136-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1364-303-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1364-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2028-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2028-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1364-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1364-15-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/3876-136-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1364-303-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2028	1364	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe	84
PID 1364 wrote to memory of 2028	1364	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe	84
PID 1364 wrote to memory of 2028	1364	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe	84
PID 1364 wrote to memory of 3876	1364	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe	100
PID 1364 wrote to memory of 3876	1364	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe	100
PID 1364 wrote to memory of 3876	1364	JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe startC:\Program Files (x86)\LP\5282\9D9.exe%C:\Program Files (x86)\LP\5282
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44cc3c802fd02f134929bc18c79c5b54.exe startC:\Users\Admin\AppData\Roaming\2DC47\6D852.exe%C:\Users\Admin\AppData\Roaming\2DC47
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2DC47\78DB.DC4

Filesize
996B

MD5
654b23a5e61043ea203c47a16c66df4b

SHA1
4eebfab1c76797598bdb358fd5340167a11c6bc2

SHA256
d159a5b70ad3d6bf0439d3f6d39564f271b9212800aa87c9311072010dffb8bb

SHA512
13420aaf51dd0379776919a366886d717ce1f7debc87bfd797208e6ee529ccc8b4dd8e73b2f06e7cb9ec65bcb8a3a147504a9c885833ba517e2a4115fd5f315e

Download Submit
C:\Users\Admin\AppData\Roaming\2DC47\78DB.DC4

Filesize
600B

MD5
c2bcc3305181ea95187149d1164eeeaa

SHA1
14d30d06478bee775e8587395dc2487504f1bb47

SHA256
eb7813f7cdbdf509fa1a2eaf17502bf607e356afdc036223638bfe73c23e4e37

SHA512
2a6be60c3a08b8f9918f092a21f22d62086ad30d219474cef03240daab9eeece666a43d3cdfab74a3741f540f49e3e0686f66d8a19e15b690b2593c3d65429d5

Download Submit
C:\Users\Admin\AppData\Roaming\2DC47\78DB.DC4

Filesize
1KB

MD5
11de3f6691d6424f78729c33a55ecb66

SHA1
7017ecb3767a4ad76662608459916813120fa723

SHA256
f5af62c57cd3939f07658c303df929f19cb0e7d7a6cc4025a06964bb9403edb5

SHA512
609f59c8904e39418bae46c39f3ba994ff3ee1de465d56730817ac6886581284f57e4dc31020357426a76165fa2b616bfa0cf337049939fd91e583b44faac98d

Download Submit
memory/1364-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1364-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1364-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1364-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1364-303-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2028-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2028-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2028-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3876-136-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing