cycbot | 15a04280442257b5f642d0a725647556e2445f021e2c247d9450205d979b203a

General

Target

JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe
Size

179KB
MD5

a3a5b5e22be71911aefdd1970fc0ca95
SHA1

a95e14ffe39862f55f94fce22ec9ba947be0d918
SHA256

15a04280442257b5f642d0a725647556e2445f021e2c247d9450205d979b203a
SHA512

5baa0d90324f3386f98cc884f295854fc04d0e1a739855e6e47626e11aaedca0584c36e68dc7ab6f9b8a368111293a461c80199b4140661124219a70a3b49187
SSDEEP

3072:wFJEaw3SmCBHCLwawe4UMhqmpaEy/2I+EM0nKEpccKSFVQHeh4RU9:wFJElC3HMuEb/r3M0n7uyFSYR

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2116-13-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4196-14-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4196-15-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/4220-125-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4196-296-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4196-2-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/2116-12-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/2116-13-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4196-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4196-15-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/4220-124-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4220-125-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4196-296-0x0000000000400000-0x0000000000454000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2116	4196	JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe	84
PID 4196 wrote to memory of 2116	4196	JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe	84
PID 4196 wrote to memory of 2116	4196	JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe	84
PID 4196 wrote to memory of 4220	4196	JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe	87
PID 4196 wrote to memory of 4220	4196	JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe	87
PID 4196 wrote to memory of 4220	4196	JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe startC:\Program Files (x86)\LP\00B9\B2F.exe%C:\Program Files (x86)\LP\00B9
  2⤵
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a3a5b5e22be71911aefdd1970fc0ca95.exe startC:\Users\Admin\AppData\Roaming\984B7\3CE00.exe%C:\Users\Admin\AppData\Roaming\984B7
  2⤵
  PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\984B7\7572.84B

Filesize
996B

MD5
c409e3d4684b81bd673be8740b3d781e

SHA1
db13b6d348ccd7292ba635523b355f295537cbe4

SHA256
20ecc1e55dd5fa9e5694f29cc4076843983f510d347e1c11ec18085a0e2f0e1a

SHA512
daf91228b939ce94dc726b75f9da2327ead5f921b3c6ac6a166112393ea462519c99f6879409fbc94ecd6012630249328274222361d987326c267f6057874e8d

Download Submit
C:\Users\Admin\AppData\Roaming\984B7\7572.84B

Filesize
1KB

MD5
4a286a8b28cac3d4d32c887e74b742af

SHA1
57c56a6e3814516d597f03e1dfdcee7bd7135ca1

SHA256
f6a332683d1e2fb38e5c34c89f305d1d7c63a37a695a7a9676340533d41aa0bf

SHA512
25a3110c46e632ef44f4c78a863fda4e84bd9090d586c04807c714c8b7716287b89aea1b131cda64720140e14d5f120644d85b3f8370189a4789a0a5355b522d

Download Submit
C:\Users\Admin\AppData\Roaming\984B7\7572.84B

Filesize
600B

MD5
9ba6d5472d97d557ddd6ce0a1822cd05

SHA1
032d4b15857a7ed46462ae3768fb4d20b42ea23c

SHA256
347d8c382ccb8cca03dffef65b76f3b313a28d21e00155e95b0afebd8d398ca5

SHA512
38159214063e94ee7862171560050c3b47aa98a79fd02a0865cf1174d1ea66157c27c89849b359c7da6f46daa4ee5904cd429dd5d964d86154c0406ba80de2a0

Download Submit
memory/2116-11-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2116-12-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2116-13-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4196-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4196-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4196-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4196-2-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4196-296-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4220-124-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4220-125-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing