cycbot | 12e9250f686cc15de6e208a336945d858d22fef52fe85da2f073e83bedaed67b

General

Target

JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe
Size

180KB
MD5

83a615fd033740f5491154fbca566cf2
SHA1

9a50294719691217c91bd854ec3e5f4f56e91912
SHA256

12e9250f686cc15de6e208a336945d858d22fef52fe85da2f073e83bedaed67b
SHA512

e00271528a6b88f1f5acf58560644e8be429040fff3b02b097e78340b33d5096b6133de583dbe251093455c9e138537ef5bac4c815d574c58ff53e6784918877
SSDEEP

3072:xrNyT5rEnfRYAL48LFs7cLAv7Ru5mRqBrTeaziES39/BOHfiyjzbiEGM7XfPK2sC:xpyF+L9Wv7TRqBoEoZBOHaIbQKKXDJpZ

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2816-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/2848-15-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/2848-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/2376-123-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/2848-290-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2848-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2816-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2848-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2848-16-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/2376-122-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2376-123-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2848-290-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2816	2848	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe	30
PID 2848 wrote to memory of 2816	2848	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe	30
PID 2848 wrote to memory of 2816	2848	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe	30
PID 2848 wrote to memory of 2816	2848	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe	30
PID 2848 wrote to memory of 2376	2848	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe	32
PID 2848 wrote to memory of 2376	2848	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe	32
PID 2848 wrote to memory of 2376	2848	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe	32
PID 2848 wrote to memory of 2376	2848	JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe startC:\Program Files (x86)\LP\0D7C\C7F.exe%C:\Program Files (x86)\LP\0D7C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83a615fd033740f5491154fbca566cf2.exe startC:\Users\Admin\AppData\Roaming\C4E1D\DA70D.exe%C:\Users\Admin\AppData\Roaming\C4E1D
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C4E1D\D62F.4E1

Filesize
996B

MD5
04be56420f0a95c5f1d99d55cc49345d

SHA1
d5005465aec1e2d7f7a4326290deaabf8d222921

SHA256
c72e03460b590e65923db122109864d197866188fda796f6c9e0002f9bda7afe

SHA512
010b7fa075ef5e9ccd9633af8b8fd04f986b19b02fbf1199aa3581ba38f1ced4142817ac2651ea5ab6a65c8b7c67fbce0f397375812c39560dd938e159f44a19

Download Submit
C:\Users\Admin\AppData\Roaming\C4E1D\D62F.4E1

Filesize
600B

MD5
dcc996243a9f9803f133a1162855d5e6

SHA1
328a20241195348c800485b497bc90a26b563a80

SHA256
13e3479772b83be847b7821d664a8dd2fb52036742e4fb1086f59e8096946dcd

SHA512
78df520140da6826fa0885862811211f837b53b5d3294e0b2237b7e98caed2f456cec8a7ca242a16ec924205e97523472c3a0926c550afafa662ddf09da1a029

Download Submit
C:\Users\Admin\AppData\Roaming\C4E1D\D62F.4E1

Filesize
1KB

MD5
53ea2b47dfb5f7b5c75697c9dd67ae1e

SHA1
3fe34cc11dfb44076837fdb6150360980aeade8c

SHA256
c76439471d1bb511249c45194ff9352737bb105b91fb64fa3576ad680d703f86

SHA512
d7b7256dbcaa32685e0bd239c1b43795fea8d84c9e90503d329dccd8f7b354b0432f76fd5120fa5fb210eaad689a5f0148ec9eb6e23e004e54f8f9d549bcdb14

Download Submit
memory/2376-123-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2376-122-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2816-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2816-12-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/2848-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2848-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2848-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2848-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2848-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2848-290-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing