cycbot | 1af2ea886f324dcba515df77f70e2a46d567315f17e14bccd40f7372e4de4b50

General

Target

JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe
Size

179KB
MD5

9e5a18b5e18c283ae49451bc8169bc19
SHA1

51a615c40cc1107faa1fc3a908a8a13e248e7248
SHA256

1af2ea886f324dcba515df77f70e2a46d567315f17e14bccd40f7372e4de4b50
SHA512

c7fda261518c1a1010db513ccb6c1b98d78e12ae8ea2fcfcc153999a53aee8c2585481335929ede33e905902a68666cad7ce686c59e414ae1528d7bcb4d10eaa
SSDEEP

3072:0zZPWZbFjm6s7W65dJd5joxFyjdStbD6qBx39w:0zlWDjmBnjd1QFezqr9

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2100-15-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2868-16-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2868-17-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/1824-120-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2868-287-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2868-3-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2100-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2100-15-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2868-16-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2868-17-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/1824-119-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1824-120-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2868-287-0x0000000000400000-0x0000000000454000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2100	2868	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe	28
PID 2868 wrote to memory of 2100	2868	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe	28
PID 2868 wrote to memory of 2100	2868	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe	28
PID 2868 wrote to memory of 2100	2868	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe	28
PID 2868 wrote to memory of 1824	2868	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe	30
PID 2868 wrote to memory of 1824	2868	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe	30
PID 2868 wrote to memory of 1824	2868	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe	30
PID 2868 wrote to memory of 1824	2868	JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe startC:\Program Files (x86)\LP\1A3B\95C.exe%C:\Program Files (x86)\LP\1A3B
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e5a18b5e18c283ae49451bc8169bc19.exe startC:\Users\Admin\AppData\Roaming\BE0CA\7D81A.exe%C:\Users\Admin\AppData\Roaming\BE0CA
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BE0CA\A6AB.E0C

Filesize
996B

MD5
83d459123c82791d486cc0381b6d7e87

SHA1
899ea1c5646e361179212a6093a4e4769935aefa

SHA256
669f40ec131193779f74a6665ebfe3fc363096666c6ea0060d264a9415c45b7e

SHA512
a8543d9a8fbe36f70bf84295664b506b628d3b0238b92a4e2ccf0910179b7b1d79dac4634676fd6fa45c9a2397cab2759394c1234b847e712cae0aeec4f011bc

Download Submit
C:\Users\Admin\AppData\Roaming\BE0CA\A6AB.E0C

Filesize
600B

MD5
09e81697bda1bd65988f6ad67df7f9cc

SHA1
25c280cb3c2eea1779b65ed1a85973ff593374e1

SHA256
6972cc4ace423626792931f914417888d5f297d7218f810afe3b136eaa704a81

SHA512
696f03e359b703446993353fbba245901a4507c8b3af20e17a6fb52021f8db034a92a20690dd6e872c2e25d5703b5a5615a896dd5a795af63c0ee17cafcb4f64

Download Submit
C:\Users\Admin\AppData\Roaming\BE0CA\A6AB.E0C

Filesize
1KB

MD5
17c438efb20b71b7aedc517c0d7deaa2

SHA1
ac38a5c47139e8ba8e66aafeb9b49373d643c427

SHA256
e8e7f30ffb80b7b67ec083dcc393fcffa60e6928335cd15a433eee58419fdfd0

SHA512
3e87be72c28db8729460d9027d7237bbb564d94b00d6a0cb3a4ba48fa8fcfbefc60dae4041bd59fc4d0abdb44102e1730e14d9d0fae2854040e8a5f2f0350a27

Download Submit
memory/1824-120-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1824-119-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2100-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2100-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2100-13-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2868-16-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2868-17-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2868-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2868-3-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2868-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2868-287-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing