cycbot | 118a5e065609e7ab81803b48a2f0da65d16b80234db23f40199d001cf078c0ee

General

Target

JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe
Size

172KB
MD5

44fbd9d7c8912ad50f2eabc715efb000
SHA1

fec8dfacc5054e63c3c65d1c69cc0f3923164efc
SHA256

118a5e065609e7ab81803b48a2f0da65d16b80234db23f40199d001cf078c0ee
SHA512

3f6e1783e3b40fcbcd6ad586b323c549aa562622fbbe449d1643f3959e19ae2aaf350620ea760a3b1d00a9a2ac19343c594ed778a9fe02c0d3cf40759c641ffb
SSDEEP

3072:oV16GDa89pb2d3xZnDhCz0kcUnjtJcNT9M8zeEQ8v6e3DMz4ZQOL2xwGjhP2zH:EQGMdhVDhCzCQBJmFeE5BXZJIhPA

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2956-14-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1880-15-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1304-91-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1880-199-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1880-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2956-14-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2956-13-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2956-12-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1880-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1304-90-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1304-91-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1880-199-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2956	1880	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe	31
PID 1880 wrote to memory of 2956	1880	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe	31
PID 1880 wrote to memory of 2956	1880	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe	31
PID 1880 wrote to memory of 2956	1880	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe	31
PID 1880 wrote to memory of 1304	1880	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe	33
PID 1880 wrote to memory of 1304	1880	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe	33
PID 1880 wrote to memory of 1304	1880	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe	33
PID 1880 wrote to memory of 1304	1880	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B8B6.EF1

Filesize
1KB

MD5
b702608d3dfaa3077abf6fd6e106b65e

SHA1
53698f6fcedda476fe2f173aacf9b7c4ca590e2a

SHA256
6709fe8291c90a9c333783a974ee77550c7af61163d901cd014c95be5031020c

SHA512
ea1d0da5d784f8606a185e3ec14edb728c7c9104addd2350aeda026d3be437242c9aa2ea1da3688c18ba00b99ac4c56d6a7c245254c63a0396e24756c9ab8f3b

Download Submit
C:\Users\Admin\AppData\Roaming\B8B6.EF1

Filesize
600B

MD5
73edee682d10b3c85b7fa9e6f94ecfd7

SHA1
95fe5d24bf83038b61f6c7528ea7873a742c5b0b

SHA256
02d20a116366617024b1ebd63f44a0e7b8cbc185dbce456b003b6b058ce9e459

SHA512
5074c7c89d4d257acd75a0f7b985269d9898ec4f7a8a7cbc1801c2cdb31fbfe034139e64d21d595f847d552a24bcc643aa1e3804f86d5b29b5bc922711a3e873

Download Submit
C:\Users\Admin\AppData\Roaming\B8B6.EF1

Filesize
1KB

MD5
55e6cdba64e6299ce455870bbe1ce014

SHA1
93b0cdcb0c9c5ff0dbf4ec1c40de611973d126b1

SHA256
7f71b338a5dc6d389213ce052f4b903e1392f0b6ebc657a88a52bc17725d296f

SHA512
d704de7015ce492d2379d42f09ac97b14c0cdb05a2bab732cad6a05f72171802aa61e849f9207ff161abbd3aa9e70e70b05a9e17887832f57a44e57a1a77c6ce

Download Submit
C:\Users\Admin\AppData\Roaming\B8B6.EF1

Filesize
996B

MD5
210c02898194d9b45a08595a669c7c14

SHA1
a56620f5ef41205e1aeb47bf35096d5183b34f3a

SHA256
0db9457fe20473111882eeae9a24b610636e1a52aeba187c83be088b763f4cab

SHA512
ce0b199e5d658d6c8a3d50837d3caf5d7645a4920fbfa6fb3d5617f4d2a0add196d975d8ac82a666f76885067e9d9158362c24c7725aa5ecd48cacc4c7083217

Download Submit
memory/1304-90-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1304-91-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1880-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1880-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1880-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1880-199-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2956-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2956-13-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2956-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing