cycbot | 78b30537960636d7670ad548ecca677bf3c12fe70013c67b7c75380af94f7b58

General

Target

JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe
Size

192KB
MD5

5c029eafa1bf0d194e908a3f0c15e492
SHA1

f9d358fccd989959292efc0132b3d8f1756c5436
SHA256

78b30537960636d7670ad548ecca677bf3c12fe70013c67b7c75380af94f7b58
SHA512

e9fbe5e883b46eb9e16677e1c8b0997a7e1ce7bbc4cfaecb14a9141c7eca76bab891a14de0605f914d935f8492d01e2bbe66aad83bb5f6e192a73e664f85d211
SSDEEP

6144:aLay5o6ySxhl6zT5JR3jtW6MP6/zhBB4g5A3:yTQyhlw5JR3jtySFB5A3

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/1836-12-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1836-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/4812-15-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3584-83-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/4812-186-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4812-1-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1836-11-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1836-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1836-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4812-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3584-82-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3584-83-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4812-186-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1836	4812	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe	85
PID 4812 wrote to memory of 1836	4812	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe	85
PID 4812 wrote to memory of 1836	4812	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe	85
PID 4812 wrote to memory of 3584	4812	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe	94
PID 4812 wrote to memory of 3584	4812	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe	94
PID 4812 wrote to memory of 3584	4812	JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe	94

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1836
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c029eafa1bf0d194e908a3f0c15e492.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B85C.0F9

Filesize
1KB

MD5
6e4383b0f57658e4792075999a527541

SHA1
d9f03c1cb6518c7449ad7e94b9cf11fd76fedf4b

SHA256
ecad9ea328189955bed0734f2a37f7428b151a67e75bd72dc207a1f886fa9141

SHA512
08c6576b7745e03a1e9c530d8f9fb772ce747f9acc7c1dc54004d713ba02c7d8d44efc9c209eb652c92f70c510034569dc5cab67585ff479bc8378ea2714650d

Download Submit
C:\Users\Admin\AppData\Roaming\B85C.0F9

Filesize
1KB

MD5
c4a18105146110d568a28c134df84474

SHA1
0f13f1dc89a0271cd49b73efa636cc3bbf03b307

SHA256
0bd3396307611c1dbc392852d4bbf1982e9713914ce1567e27f0f7a64fd17f16

SHA512
c98e099f440a3d5af96bd25267e10752e8ac3d7ef9a55b8b030a696eb46f31a875385497e5c5affa9184e35045f6378f398fcd44ddea93766ae175ab9a3baff4

Download Submit
C:\Users\Admin\AppData\Roaming\B85C.0F9

Filesize
600B

MD5
a91cf1c3c81d85117e49e4eb539a886c

SHA1
51b81d8825620ed4cf8c6fce97c827881ed71b3d

SHA256
eb1a3be6c82167b15fd7488de3bae8f2301c98eb9114474706dab7b55daf45a5

SHA512
59ac5458c623eba7ee82f187a4c9dca84392032745aacf1ffa488e6dda09431b8c75794fc19f496a5a8f1510f4b36bde8f43ab300e5a32e844fffb01de1f4aa3

Download Submit
C:\Users\Admin\AppData\Roaming\B85C.0F9

Filesize
996B

MD5
0abe3f78c889f80ac865fda7fdb908b7

SHA1
bb75e887798b90a5a4e8d99358ca8ab6639de788

SHA256
9fff9d72de2bbd1ec58e435c3b561b97594e7c3db2c46397c1aaea8adbe666f5

SHA512
243e16d589268bd18665ed3783fce6a437e377f9b2931cf133a9d8b1acfbf08994ec093a1f6e5ec6f67b4cfbfde7e9c11791e53d31303099231505af0f59c629

Download Submit
memory/1836-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1836-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1836-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3584-82-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3584-81-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3584-83-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4812-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4812-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4812-186-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing