cycbot | 649259bd422eda322ca7bf5ecb7d447e47f7e561a3aedc07073e1db639a85a08

General

Target

JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe
Size

181KB
MD5

9b7e58c5b055c730c3a29842b3a0454d
SHA1

dcea513d16ea1de142c22a0f37ad1a1e0cac427c
SHA256

649259bd422eda322ca7bf5ecb7d447e47f7e561a3aedc07073e1db639a85a08
SHA512

c180afcd2107a2a02a85ce16f670ca9e3523fc3c6a6c3b597a888ea1e4ae9c030d412a899158cdad0da0e85a8ea7a4399620dca8ba9b73634574e6a48d603768
SSDEEP

3072:qQDVNrxqGNbJLvAGCLYYYWLK6tYKtODk96Z4G0HteoaVPic422JL6dw4FJSlzB3:frkqJcAYBftzOE64G0Hko0qcE6+2StB

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2780-7-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2156-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2912-81-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2156-183-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2780-6-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2780-7-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2156-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2912-80-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2912-81-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2156-183-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2780	2156	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe	30
PID 2156 wrote to memory of 2780	2156	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe	30
PID 2156 wrote to memory of 2780	2156	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe	30
PID 2156 wrote to memory of 2780	2156	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe	30
PID 2156 wrote to memory of 2912	2156	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe	32
PID 2156 wrote to memory of 2912	2156	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe	32
PID 2156 wrote to memory of 2912	2156	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe	32
PID 2156 wrote to memory of 2912	2156	JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b7e58c5b055c730c3a29842b3a0454d.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9A52.425

Filesize
1KB

MD5
c6c94ec45165fa29c5ce4a4c39798895

SHA1
6d7f73c48de47dfa9b2873717443798b874e0002

SHA256
a3fa2d9c73c476ec5a0e21ad51533a777704f7a3e5b342939c33e662ebb1c03d

SHA512
232ab9cc0e6290d6daff125cec3bc0fd7039712364fd6b4663c3cb9e233032138758c064b755955055f1d589986849eaab6d759723d9d7bfb00264adfcea961f

Download Submit
C:\Users\Admin\AppData\Roaming\9A52.425

Filesize
600B

MD5
b1f49d268a1521c830c819d92c536f35

SHA1
a854377287424656941f466ce021dace0b468e15

SHA256
f301285d46c841b49c5d6df5227085448fb7bdbf407c406969e91b35b5fb9400

SHA512
e1a13127d2c97bb71432baebf2172d6345e9075556e55f3bc854d30ec7659f866dab79188d94796ea0f15aa5bb62607adfdac1361a161344d776471601ab6ad5

Download Submit
C:\Users\Admin\AppData\Roaming\9A52.425

Filesize
996B

MD5
fe8334f1df9abf8ce0bed5fdf7daaa6b

SHA1
69fe39d5dd0931b6cfcce49336aa9a692d5e0452

SHA256
13532b3dc3eccb72cd98ab1687a98afd50e3aae3ef971673d258b5799506b9b2

SHA512
a398b323c009f30fb2f81293a822122a7b9ec9b513fc453980748d96668c2ac41897881ee54aedcbeabc18e24da390a46d7710a22932d0113120cf32756474cd

Download Submit
memory/2156-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2156-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2156-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2156-183-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2780-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2780-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2780-7-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2912-80-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2912-81-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing