cycbot | 2b9223e59fc80dac2e4d447b8059de000b87743985bb2e9aab8969305e729287

General

Target

JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe
Size

180KB
MD5

7854f659cee962818055d8e5e068acc4
SHA1

708cda3618bbe2d578750a24efac6e7bb07641d7
SHA256

2b9223e59fc80dac2e4d447b8059de000b87743985bb2e9aab8969305e729287
SHA512

ff116f195c4527d13f7368e9bfc2de08b083c722a8f9d0fa0ed131c0b21004050ef7d83f58f40facf676b1fa7ec01f21a89a333c9036b3d3ab841f091ff54a56
SSDEEP

3072:/vox12+nf24ert0IsrgQ8lIdGxblSHepOg6X7VLy7Oo2MXvQVxQUMrxsL9RlM2b:noxR2xZsUlIIzSOOg6X7VLk2MXvAxQUn

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/768-14-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4912-15-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/4912-16-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/1736-135-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4912-314-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4912-3-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/768-13-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/768-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4912-15-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/4912-16-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1736-134-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1736-135-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4912-314-0x0000000000400000-0x0000000000454000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 768	4912	JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe	84
PID 4912 wrote to memory of 768	4912	JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe	84
PID 4912 wrote to memory of 768	4912	JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe	84
PID 4912 wrote to memory of 1736	4912	JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe	99
PID 4912 wrote to memory of 1736	4912	JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe	99
PID 4912 wrote to memory of 1736	4912	JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe	99

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe startC:\Program Files (x86)\LP\F0B8\5FB.exe%C:\Program Files (x86)\LP\F0B8
  2⤵
  PID:768
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7854f659cee962818055d8e5e068acc4.exe startC:\Users\Admin\AppData\Roaming\8A3F9\447F0.exe%C:\Users\Admin\AppData\Roaming\8A3F9
  2⤵
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8A3F9\9268.A3F

Filesize
996B

MD5
a12bfe247bba1bbfb2afa1cc2e483c4d

SHA1
fae28d2dd8234f0214b87661dd4b8d5f17cf5c91

SHA256
0e76936167f945c9382da9c1880402f4fb69ff8782d4e3ccbbb33eb55cecd795

SHA512
585bc89161cc08284b25f0321944f022c3dd07b22686efc78cdad497a39f2f75e7336743964ae6a1d18aab668b23c6b775000a9ef770be38a8d9b9e68a26c7a5

Download Submit
C:\Users\Admin\AppData\Roaming\8A3F9\9268.A3F

Filesize
600B

MD5
2e9c63bb6fae23e8405184f0a9355868

SHA1
0e24c395a3b4f500c9fb960ffa1554433f83276b

SHA256
61ae676862317aeba15a62aebe18be4895884c64000c27163b31d2cfcef18575

SHA512
3fcf009463f7632444c3bc7d6798e32c4cfdd540d8c715d514ea01392b416de5e9f48c5ea3d59ce192d5f7f2408da625b54a7ce98fa6341d8fe05c64fab454b8

Download Submit
C:\Users\Admin\AppData\Roaming\8A3F9\9268.A3F

Filesize
1KB

MD5
716b8831e2c9b1c74d6ea218a97a7cdc

SHA1
f1ddaa6bcc8faef22a352167fd9b18f8d5829ebb

SHA256
b57b57e4cd4841f4d7fb045867f07168389c8f64b8015afcf4cf4cfc7133d551

SHA512
5ea10fbdbd0215258c70f99354f27b6dfbb8a7247cb3af61fbd2384f367a7ff9d36f5af933721f384c0a8bb2e87b534b828954f4d0654b231c0c6db28677dcd4

Download Submit
memory/768-13-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/768-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1736-135-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1736-134-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4912-16-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4912-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4912-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4912-3-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4912-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4912-314-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing