cycbot | 4bda2a432c5282559d6f4f59e1886ddd2620468a2187af0511b00b9633f54d56

General

Target

JaffaCakes118_98371e807425a7344432b08125335874.exe
Size

209KB
MD5

98371e807425a7344432b08125335874
SHA1

c42a4a7c62a5507ff88ada4e95999c5fb49a579a
SHA256

4bda2a432c5282559d6f4f59e1886ddd2620468a2187af0511b00b9633f54d56
SHA512

f75aacb53b3868ee588d9a339488141a21b523700387c325554fbc6c368bf8fc51947b7e4b932340526c093aa28a859c7f4fa394023f304ba7fd589016415a7e
SSDEEP

3072:Aaq5ctoD15rgZjOM00Ez1OfXXxGNrFqqmstTTKd9VxYBv+nHdNN/gLNxuOsv:A55Oa15reXCOfXoNgqmstT0GO9NI3

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1700-7-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot
behavioral1/memory/2324-15-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot
behavioral1/memory/2656-80-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot
behavioral1/memory/2656-82-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot
behavioral1/memory/2324-179-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process
PID 2324 set thread context of 0	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe
PID 1700 set thread context of 0	1700	JaffaCakes118_98371e807425a7344432b08125335874.exe
PID 2656 set thread context of 0	2656	JaffaCakes118_98371e807425a7344432b08125335874.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2324-2-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/1700-5-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/1700-7-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/2324-15-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/2656-80-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/2656-82-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/2324-179-0x0000000000400000-0x000000000044F000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_98371e807425a7344432b08125335874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_98371e807425a7344432b08125335874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_98371e807425a7344432b08125335874.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1700	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe	28
PID 2324 wrote to memory of 1700	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe	28
PID 2324 wrote to memory of 1700	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe	28
PID 2324 wrote to memory of 1700	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe	28
PID 2324 wrote to memory of 2656	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe	30
PID 2324 wrote to memory of 2656	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe	30
PID 2324 wrote to memory of 2656	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe	30
PID 2324 wrote to memory of 2656	2324	JaffaCakes118_98371e807425a7344432b08125335874.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98371e807425a7344432b08125335874.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98371e807425a7344432b08125335874.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98371e807425a7344432b08125335874.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98371e807425a7344432b08125335874.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1700
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98371e807425a7344432b08125335874.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98371e807425a7344432b08125335874.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EE6C.954

Filesize
1KB

MD5
a8271a050e93c7f45f31077d4c57b382

SHA1
fac7186f1721e620947958d957ad7f9ab7f5d734

SHA256
75520625c2f3017c418de4e9e91f1292199b8ee469e6659f31ce5570d7a86b81

SHA512
2c7086fbcfca8da5fe1961402bebfe2a2c8af3663841b61d4a585290b3183818af9816b132faae34745ab8fa210b5b33b8c9bc9f099ac4b0d3092cc6dceb302a

Download Submit
C:\Users\Admin\AppData\Roaming\EE6C.954

Filesize
600B

MD5
e7cd340da2e11f4dafe2b59f4422a25a

SHA1
bc90a446b410b375d8a719dfcf22c83c7341658b

SHA256
dafd01d935625a172e16d908020dbe8c2a08f341047ce2c7e141d8a253d113e4

SHA512
bff03e685ee8ee71ac748ac942704c087af24ed5bc351820b2fbe443ec27dd3a799d075df98c9ec1c2ae9f36f4056c0711eceb4dd94b046c129546f0eeb8cdab

Download Submit
C:\Users\Admin\AppData\Roaming\EE6C.954

Filesize
996B

MD5
89cbe5983998eafc63b76811e85caa4c

SHA1
d4b19cce01d890a9598825b02a6c557712ae2d2e

SHA256
a149f7c82bef6de34047e4677808912a1353470faf10465fb071c9c20c0fce7a

SHA512
675ee34cc655b6555295d0b5b4c55521a2a6b4165ac50c9c73da5f39eb3d60ab137cc8fb52728dd75841e985e7f0fb9db654cf6d18a712e0c540d560a55a6049

Download Submit
memory/1700-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1700-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2324-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2324-2-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2324-15-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2324-179-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2656-80-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2656-82-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing