cycbot | 15548c8a0f5be8a06706c25d10f201dd7912dc8d882a7e637daa414fb3baddba

General

Target

JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe
Size

196KB
MD5

79c26468bdd7049e1a48ba91bce967a6
SHA1

109fdc157699650f8be16f95d881f98bbbb40884
SHA256

15548c8a0f5be8a06706c25d10f201dd7912dc8d882a7e637daa414fb3baddba
SHA512

0de84059c273d5a2da1aab811d8c0068abd269a46602289ef49260572b2fd2849ce75ea3c240d4606d2c62bf303bee5ce5acf5d4477201e3c644ef7926756d89
SSDEEP

3072:B3WZrM3EB6wj/iesfXb17Nxiva4cAHEHiPZqX9y638G+kGP6Ozweq94t:B3f0d/EfLXkvazARxqX9h329zwo

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2780-13-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3532-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3532-15-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/1540-126-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3532-285-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3532-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2780-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2780-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3532-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3532-15-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/1540-124-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1540-126-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3532-285-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 2780	3532	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe	84
PID 3532 wrote to memory of 2780	3532	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe	84
PID 3532 wrote to memory of 2780	3532	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe	84
PID 3532 wrote to memory of 1540	3532	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe	90
PID 3532 wrote to memory of 1540	3532	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe	90
PID 3532 wrote to memory of 1540	3532	JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe startC:\Program Files (x86)\LP\1B1F\D85.exe%C:\Program Files (x86)\LP\1B1F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79c26468bdd7049e1a48ba91bce967a6.exe startC:\Users\Admin\AppData\Roaming\F15B5\6C81B.exe%C:\Users\Admin\AppData\Roaming\F15B5
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F15B5\51A8.15B

Filesize
996B

MD5
74ffe8e7b732f09c193928fb497f65cb

SHA1
f2e5c5032d3a8684c882ce62e9e381156beb7657

SHA256
ab455a441171ab0337ff85ee39e559537b0ad2aa55de8801e6c2f09cd09f67ef

SHA512
7c06148afe68bb95d3ffb9e807a2e2e6edb70a42ab21c702cbed0d7888384ce8720738fd6827e2861715f9c4670aea4f9e87b3ae88a22b270870e794c3b6b19c

Download Submit
C:\Users\Admin\AppData\Roaming\F15B5\51A8.15B

Filesize
600B

MD5
47b932a58936e56e6fe81c1e6d675606

SHA1
994b075c8928b5330ea3d9b1a4ea2be4d19d9872

SHA256
d204afa625d7eeb6dc29a273dc206fb9217fadd3c02485d470d5e6ee64ae72fe

SHA512
16d85ad8636824d556dc4cc61b8af9141b7b942b9937afa5c49715c0ac2d49545ddb58b18ad4ea075f96d3135c3bd454a21a3fcf79b916b1f2b931cc92c610dc

Download Submit
C:\Users\Admin\AppData\Roaming\F15B5\51A8.15B

Filesize
1KB

MD5
5468d9f00388243f5aef85c216873024

SHA1
7a845607ff50970d460823be4c43a2d3f766187b

SHA256
5f3a40cbf1d963ebc965501871deafac4fc5c95a431edfc5e1ab49f5f54935f2

SHA512
e7f1ee595b5d7db64519a4f4f3e2618213f1dc69c8458251aef20a525223d6e17248ea3baf06a63dbf192ec4f4b9a134a459bb4334963e940cf724ee2f40bb89

Download Submit
C:\Users\Admin\AppData\Roaming\F15B5\51A8.15B

Filesize
596B

MD5
e2df9ba8f3df71a60efcc67ad2702807

SHA1
eff3b70025197681682cf984e1288cc0a0caf3ed

SHA256
312f89c45dbc3317aeef1d85934faf786b4c9b080239fc27ca878a0afc285a06

SHA512
5530ecc752e7e706e6d1090350427bdeeaf250a27ce9135c8a00c7ca725751040a3b4c460c035cfe418efc2189a7091812d22bc2bd1fbbed6d1f4cb144873f07

Download Submit
memory/1540-126-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1540-124-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2780-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2780-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2780-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3532-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3532-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3532-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3532-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3532-285-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing