cycbot | 4ee97d6cc416d739fab24c8329db6eaf60af578f3abb7b4f8a637dc15f039ed4

General

Target

JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe
Size

191KB
MD5

5b64f9b74106e4d74ed0da5d37ec39b9
SHA1

4947492b931f9bf8a414bbd2f81c26e8eb193b0f
SHA256

4ee97d6cc416d739fab24c8329db6eaf60af578f3abb7b4f8a637dc15f039ed4
SHA512

272e4fc2d6b9e5c91f2ed0244ff483de7ce0d40f2deb32a94ab9c2f4cb8d3f4ee6c6bd133c6254b37ed30c371ddf229c7e48e44823fab7fed2d336df6d54a0e3
SSDEEP

3072:TQLwLPU/TVs57XD0czIfYMTt3OQRb4Y/toU52MjmdxPyIU4IRD2oITI6CnPJouml:0NTi1DjIfYMoQRb5jmdVyIyRDPl6mef0

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2524-5-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2396-12-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/1696-76-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2396-168-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2396-199-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2396-2-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2524-5-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2396-12-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1696-74-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1696-76-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2396-168-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2396-199-0x0000000000400000-0x0000000000447000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2524	2396	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe	30
PID 2396 wrote to memory of 2524	2396	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe	30
PID 2396 wrote to memory of 2524	2396	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe	30
PID 2396 wrote to memory of 2524	2396	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe	30
PID 2396 wrote to memory of 1696	2396	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe	33
PID 2396 wrote to memory of 1696	2396	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe	33
PID 2396 wrote to memory of 1696	2396	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe	33
PID 2396 wrote to memory of 1696	2396	JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b64f9b74106e4d74ed0da5d37ec39b9.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4F97.56B

Filesize
1KB

MD5
26d1a2bbb2f2287b5a3be74583628231

SHA1
28a4c546ea2684a8acbe114a154eca7d04b8e040

SHA256
34f620b7a615c602885740944fca99bf996e5385aea2f071cf7a19c755b271b6

SHA512
833ed39e5918aacff8fadc140d471f8ea7599fcd7530d3ad03a84757fea900279e56cd96dc95532c2d1297d9ade43532c26c71479739d20c0a20a0fa91a0c708

Download Submit
C:\Users\Admin\AppData\Roaming\4F97.56B

Filesize
600B

MD5
484e3cf3069abcb2ebb20cf311603802

SHA1
76dd5d2d028e7291e7214fe1eb7ce608f27edc3b

SHA256
f346075d560e404a666fcbf4fb584f371c98b3eeb236c23dcf922c26a5774b35

SHA512
9d167888a0de5b387487d09144eb1e3f3971208c18405f75bb02a595a81eb2132be429c1c0258a7919f92e80afbbfa73c5ae575e56658d5b2f6c2a432c4b624e

Download Submit
C:\Users\Admin\AppData\Roaming\4F97.56B

Filesize
996B

MD5
70bdff80f5b1350b1cbf0d5ee63f7063

SHA1
7911904a6f954fe2f99ca9182fc43d5b4839eb20

SHA256
e1c2ae5014b507d8fc93f52f8fc69e7d3f6a6c1f1916c70e247aa09189564163

SHA512
18cc67d6414b2e358969beaf4fbaa92b0669cdddc6a77193c0bcbe1962a806ba3ebb74d7a23548d75a3695f15b59a6920892dc4dc3d0f87d7d6b0d801e48373c

Download Submit
memory/1696-74-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1696-76-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2396-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2396-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2396-12-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2396-168-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2396-199-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2524-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing