cycbot | 284924073f5af263a4c912c08509d4dfcf57212d86523d67fbd6c8af84c62e89

General

Target

JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe
Size

186KB
MD5

6208fcb3770c2757f15c796fab390fff
SHA1

60804cd67043142fe55dfc084a435422d2e89531
SHA256

284924073f5af263a4c912c08509d4dfcf57212d86523d67fbd6c8af84c62e89
SHA512

dafaa4aaaf6abb6cd5a2281d5c8d51957cf622ef91e8c057754f9d7e017af82dbebeea6cd99201f19f05a4207b1fd6437b7e06f5ed9aaa322dc9242424c04e31
SSDEEP

3072:e6QEOCDJD/sESf5SnjMHvgfGZ0BTC4RF9PSjy86tGdiVqFN8vyXjI0O0Z7Q4sOsq:JdOUD1DMgk4RFqT60duqFNyiI7AM4HGP

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2924-13-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/1528-14-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/1528-15-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/1920-131-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/1528-294-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1528-2-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/2924-11-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/2924-13-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1528-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1528-15-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/1920-129-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1920-131-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1528-294-0x0000000000400000-0x0000000000454000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2924	1528	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe	84
PID 1528 wrote to memory of 2924	1528	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe	84
PID 1528 wrote to memory of 2924	1528	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe	84
PID 1528 wrote to memory of 1920	1528	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe	98
PID 1528 wrote to memory of 1920	1528	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe	98
PID 1528 wrote to memory of 1920	1528	JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe	98

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe startC:\Program Files (x86)\LP\E931\873.exe%C:\Program Files (x86)\LP\E931
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2924
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6208fcb3770c2757f15c796fab390fff.exe startC:\Users\Admin\AppData\Roaming\1A227\AEBE9.exe%C:\Users\Admin\AppData\Roaming\1A227
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1A227\7590.A22

Filesize
996B

MD5
89ccf827fe6ce2e2376f9b27593d3c01

SHA1
5b59c5df0bf76aa4e40a3afb7173ae6e1257fe3e

SHA256
9bfc8f3ee99cc56c1796f6715362d30105cb1400892edd58a289638137cb18fa

SHA512
f7526f460d044598393e5a3c47435a64518872df4b6d4b8b6c3db7a6fabc67a3a8769e2972127e1b0dd96bc8499857526d351fd169082cb5e2eab9e42f38bda6

Download Submit
C:\Users\Admin\AppData\Roaming\1A227\7590.A22

Filesize
600B

MD5
39f33ca46d0106931deec443532e5690

SHA1
c7cc4deea76e51aa0395631f5d130018ead68fab

SHA256
181c8b86ede662cb46dac64288dc715ef89493398c7746c348978060b5fe4d76

SHA512
554bc794983876a380e81e39ed760d0a69cd4c19e07049b890efab08cf76111be1eb6d5a1e0284699041e2b92c57a3868e7294ea56f7b6708d64d7e13fa470bb

Download Submit
C:\Users\Admin\AppData\Roaming\1A227\7590.A22

Filesize
1KB

MD5
44d3864387dcf0557952dfaf3ac02726

SHA1
9ef6411238b85e951aca45cf21767273a0ab72e4

SHA256
c4935ac06a41b0738124dceee8394d95eea5439d3146aaaa2f6735338cd99226

SHA512
861ebbbc43d854008d03f7acbcf32c4bfa8d89d139854d13d5dd89f56e49eed225caad009730f5af4ddaceb2e6e7eab33f392d1ec1613a65cf959f4a062afbd7

Download Submit
memory/1528-2-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1528-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1528-294-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1528-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1528-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1920-131-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1920-129-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1920-128-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2924-13-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2924-11-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing