cycbot | 6d2cf4d4a4c532e87330f37aff3502515647fddae56bd59c736bbac2ec91c793

General

Target

JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe
Size

174KB
MD5

a1c70e96baaa0708a254d7594098dfff
SHA1

eeee5937c5c59114a8d5f18b02f8e7606704e907
SHA256

6d2cf4d4a4c532e87330f37aff3502515647fddae56bd59c736bbac2ec91c793
SHA512

d0902a5f699ff1a1b91db56818e342f9f4a3212a247d939672a2e4ece94ba727e5640d0e5a79765bbf6de7176e29ab26e0d347fed115fe8a1765266b9c2447db
SSDEEP

3072:N/NnJ8jM304+16bvx67wm2EwiID0BFkxFRmv7WFwrKzSU/TkRjOQyr/8:NNqukMm2E0KKVBqKSzVn

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2188-7-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/1860-15-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2732-88-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/1860-189-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1860-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2188-5-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2188-7-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1860-15-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2732-88-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1860-189-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2188	1860	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe	28
PID 1860 wrote to memory of 2188	1860	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe	28
PID 1860 wrote to memory of 2188	1860	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe	28
PID 1860 wrote to memory of 2188	1860	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe	28
PID 1860 wrote to memory of 2732	1860	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe	30
PID 1860 wrote to memory of 2732	1860	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe	30
PID 1860 wrote to memory of 2732	1860	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe	30
PID 1860 wrote to memory of 2732	1860	JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a1c70e96baaa0708a254d7594098dfff.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\52C8.874

Filesize
1KB

MD5
fc024fe4d578f445baa5fd66d04b12ec

SHA1
3ce4287ab1dc6e9a628cce7efb064a47b33d197d

SHA256
0c9534ef39cec6eed2fe3beb69eeecf7b2d5b2e7f9673eec1679695725c99307

SHA512
e3434a826dd8d77be2978e7c277ad6b8ada7129fcf0d9beb3e3a9bbdc99fd533c3769598389413ed3fc73cf5c7d6ec44ebe3371490dbc3070a52fb6fddca0aa9

Download Submit
C:\Users\Admin\AppData\Roaming\52C8.874

Filesize
600B

MD5
3a7b438270adf0ef51fa6ae64cdeddad

SHA1
f8414f8e2407dfb91240103193575b4f812bc540

SHA256
5dcc267d46beaeb5463c298d40358174e575bb5bac920e8de7b17e04f238b2e2

SHA512
6274b85adab7c0c743274fac1bf851f68098782b45961385f1c73e8274e4ebf8bb848c302ad8ccd6e77bd57faa4d3aef8f00142b3a48254de87a35502f286836

Download Submit
C:\Users\Admin\AppData\Roaming\52C8.874

Filesize
996B

MD5
de93689b5a07d3440334078e5f87a7c1

SHA1
851fd08da07d09c69d8cd1ab5018c6e1f545165f

SHA256
744ccccbe7aa0f5446c223b6266b2df77f1de70b5a4a6b3d8064035d0c789515

SHA512
09586dcc07024efc2045d7135d637d37ed668d73a5dd4f54be388c7b9389d0fb4b940cd877cfb692ab1707f2d3f684fcf19931affd71657519debeb7e6331808

Download Submit
memory/1860-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1860-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1860-15-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1860-189-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2188-5-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2188-7-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2732-88-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing