cycbot | 7ce88f4ca91120ea1152b65732ff0fa511e59b8d7d1edb37a1d1b4d334b6393c

General

Target

JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe
Size

214KB
MD5

7104d3fce18c367a6877e84ef2a3eb6f
SHA1

cd0be65487c10655ea2c21ee6ca3996785c76a5c
SHA256

7ce88f4ca91120ea1152b65732ff0fa511e59b8d7d1edb37a1d1b4d334b6393c
SHA512

410fae7bf7826dbd2fe983f74af1d150f9ae4776a2b10b4eb732cd7659b52042b3f8051b07a724d45aebf583764b5860cae22fde6fad73d6f5b29d84f69de55b
SSDEEP

6144:AKD8THq44FePMwR74qhQEMkJI5iGmUv03/:AR7D4UP2Ae

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2612-15-0x0000000000400000-0x000000000044C000-memory.dmp	family_cycbot
behavioral2/memory/4308-16-0x0000000000400000-0x000000000044C000-memory.dmp	family_cycbot
behavioral2/memory/3660-81-0x0000000000400000-0x000000000044C000-memory.dmp	family_cycbot
behavioral2/memory/4308-176-0x0000000000400000-0x000000000044C000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4308-2-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/2612-13-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/2612-15-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4308-16-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3660-81-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4308-176-0x0000000000400000-0x000000000044C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2612	4308	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe	82
PID 4308 wrote to memory of 2612	4308	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe	82
PID 4308 wrote to memory of 2612	4308	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe	82
PID 4308 wrote to memory of 3660	4308	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe	88
PID 4308 wrote to memory of 3660	4308	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe	88
PID 4308 wrote to memory of 3660	4308	JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7104d3fce18c367a6877e84ef2a3eb6f.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6CB4.08D

Filesize
1KB

MD5
ea916715c20071f7066336555e5a3e31

SHA1
d75e04fdc228de6eaddb6ef948f020a2e3671818

SHA256
d921df38edb5a927e92c156a11eb9868dc8fa3ec6a8e89747b02e5ed5c8788dd

SHA512
dcab0d66575711b246d1e7527c59a774f9a62c7b4784ee0330920c90a5ae70abb84fb37e308a7ca1e9c5a76ec8560fe6d04b65f05d3a9ff03aca17383af639d1

Download Submit
C:\Users\Admin\AppData\Roaming\6CB4.08D

Filesize
600B

MD5
d8f77cf70783c050dcf20dcca82ef6aa

SHA1
a23203c160dde0194d3aede8672bd78c8b068f99

SHA256
c5b985e5a355f6702474718010c6766b4970bdf7a99d6ae453c2ea88f5a10156

SHA512
eeff44c9ab0fad4793c352a2e99dcf7be441056b86e71f6a131bdce8d38474bd12725ce60f4eddcd6615061748b4be16904214250ed61899828d1064b05c6031

Download Submit
C:\Users\Admin\AppData\Roaming\6CB4.08D

Filesize
996B

MD5
763ea577b84a5a5bccf5cb2c8ce733e5

SHA1
d08775f2c9b83f5248b1b03917210f66f2b901d5

SHA256
af28b0df941b50e9555898b3c3f3e8b2e909ee4afd1cf9e61e58e8938c67b89c

SHA512
3fada8dcb5df1f2d43f96aee886bbb31a6280b73b89fe1a088b73a54980c8ef0e53de1e1c52d3431a10c9d492443b2ee975d97aaac5c1f10b3d0e43dad8d0ca7

Download Submit
memory/2612-12-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2612-13-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2612-15-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3660-81-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4308-1-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4308-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4308-16-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4308-176-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing