cycbot | 4c3ce8ccf974b1f26fe88ea11baeacfafd3bedb308045cc029c59fe594dd2171

General

Target

JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe
Size

182KB
MD5

6a409442ed9d7cac7a62cc4008e1b96c
SHA1

3e56f19450587c4e0ff0a40253821509a8c005e6
SHA256

4c3ce8ccf974b1f26fe88ea11baeacfafd3bedb308045cc029c59fe594dd2171
SHA512

d02abaaa292378d105958c67dce5f96357f8215d8f2a732f799dd4ad1019531e413272fc2d1bb27447e8f056d90ec5858ad4d41852eb48971aacf7fea2eb063e
SSDEEP

3072:pZ9kn7uk4bxzpQDyiJHp6gq6/ButZzT9C9UlzEyYqODI1VnH97oG+axt:pPDhbuHAl+Bur9CiuqO057oQ

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2548-10-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2548-8-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2548-9-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1860-15-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2424-83-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1860-184-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1860-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1860-1-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2548-10-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2548-8-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2548-9-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1860-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2424-82-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2424-83-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1860-184-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2548	1860	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe	30
PID 1860 wrote to memory of 2548	1860	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe	30
PID 1860 wrote to memory of 2548	1860	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe	30
PID 1860 wrote to memory of 2548	1860	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe	30
PID 1860 wrote to memory of 2424	1860	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe	33
PID 1860 wrote to memory of 2424	1860	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe	33
PID 1860 wrote to memory of 2424	1860	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe	33
PID 1860 wrote to memory of 2424	1860	JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a409442ed9d7cac7a62cc4008e1b96c.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0FBF.3CD

Filesize
1KB

MD5
0b5f8cb2a83170953a20a2f61d14100f

SHA1
4826a3a87351f4649586e13055b4236f1975cb51

SHA256
22a50c8a00a02b685a0bc457c3e73a7f823ab84b8508aa9821723826d97ddbbd

SHA512
d1062dd735c7a52522ac22f301ede81fd00b12b18bc145b7276081a76fde150fc7d1bd897d5a988e6dcad4469208946b6fa109f5d4638b8c0d9fb2f011562f2e

Download Submit
C:\Users\Admin\AppData\Roaming\0FBF.3CD

Filesize
600B

MD5
d641ea34f98ca2af21fa0612110e6938

SHA1
a31ff62f390a07d65e99645379b2fee2016e6194

SHA256
edb40eabdced658f5438c0ee428579711b561dcc4e96510a0f3d41ad506c7b49

SHA512
e79a9a56d667825c0268077e4d6fb769d3fe422f035c6d3aa89a6399b643066671192188e4ae12071d0fbd23f6a53cfac7dcf3e0f2e68bc82047d633c66ee380

Download Submit
C:\Users\Admin\AppData\Roaming\0FBF.3CD

Filesize
996B

MD5
ece05f90fe05f0f312f7eba473ab3829

SHA1
3cadfae6a73087753ade738086b18b2327d72259

SHA256
32a3a3414e5fc4c1cd84a111832a8d870581f99635312c2ef5d3f422cb4758a3

SHA512
819a0988d95ed07be833dfa038e652b3ca12a8416e49603842fb3a2c106158ba43e94bee4a6f0df2fe44f5dc2de17207d9e523cdd49c97b7187bc55fb43f900d

Download Submit
memory/1860-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1860-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1860-184-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1860-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2424-80-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2424-83-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2424-82-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2548-9-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2548-8-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2548-10-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing