cycbot | 4c1c55cdaf838fa132a2e315038c6e5327b7afc6f331ec167e0c8d66ee2292a4

General

Target

JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe
Size

201KB
MD5

6ee43bf19bf95f3ab11b196d341d824e
SHA1

25517c9d7beebc4be4fdb4f5061c9bb4bb3f0daa
SHA256

4c1c55cdaf838fa132a2e315038c6e5327b7afc6f331ec167e0c8d66ee2292a4
SHA512

eea92b73e108de4e136ad594d04ba8543cbe7742f22c2a7a7b4c7216bb2b48fc61b1b888d9fa9f996e3469c9b86f67ac9716f44faf161b9eda077411ba3b26d0
SSDEEP

3072:+959g9iOTU74GAwAorHDHSFXKY1CGLgRUnwxRYqj+hCoz3rTZlc0cXRfnzg:MgTTU74GAwAWHIaY0SW0hCoz3bRg0

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1864-13-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2120-14-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2608-80-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2608-79-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2120-181-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-2-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1864-13-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2120-14-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2608-80-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2608-79-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2120-181-0x0000000000400000-0x0000000000469000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1864	2120	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe	30
PID 2120 wrote to memory of 1864	2120	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe	30
PID 2120 wrote to memory of 1864	2120	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe	30
PID 2120 wrote to memory of 1864	2120	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe	30
PID 2120 wrote to memory of 2608	2120	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe	32
PID 2120 wrote to memory of 2608	2120	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe	32
PID 2120 wrote to memory of 2608	2120	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe	32
PID 2120 wrote to memory of 2608	2120	JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee43bf19bf95f3ab11b196d341d824e.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0CA1.AE7

Filesize
1KB

MD5
63cd57823d6d8f4c19bcda80852f6396

SHA1
1f0f5e0713e2c9a47780f72dcb09060a51440ece

SHA256
7ae4744329ae524689e80fcb0d4c8505a36fde6583e7541ef2516fe5ae693299

SHA512
cb409d87f3d6961dccaf0382b0598278b828ab5b408b8b55d1548094d4d45d1398564ca5f07bc19525ecaa503c9209751ee828c769a0a16b2bbdedb8c8b69eaa

Download Submit
C:\Users\Admin\AppData\Roaming\0CA1.AE7

Filesize
600B

MD5
f4550c9c51cf7c0b8ca6fe9684fefdb0

SHA1
932bf08fcea4007a0ca07ef05b08fd0320b977fa

SHA256
e38452800bf2875c8f454acd63e6c22cf6c588031a0a703d9ecec108da1bba7d

SHA512
e8b18a6f4245b8522c0a8e849e9e553e82a6a003dddfe1eb2c00912c57303060996ba6064faccb88e837ab4a3b5e17bdca386973593106f54e8ba823056e57f6

Download Submit
C:\Users\Admin\AppData\Roaming\0CA1.AE7

Filesize
996B

MD5
6d72944519e0cac02bcd01a6f99c8a2a

SHA1
b0afeea03aef6bb0004019894e2fc230e1431b63

SHA256
2fe7a7c8d2643bb009cd1c387cd0c3b3a1673606b6db849257683f60e4154fd7

SHA512
1e94ee1744c69ced8bc5a64e241d5d4dcc1872fd1189824955cd76d58bf5665c0ec0e2cb4ea2550f161e1a2b07c367b22adbb325f900486ae72f3f7e9544d8c3

Download Submit
memory/1864-13-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1864-76-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2120-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2120-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2120-14-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2120-181-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2608-80-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2608-79-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing