cycbot | 4bfd4f372b542147b9e20f49ff1e48e4ada86ec4670603d190d351891e8633b1

General

Target

JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe
Size

187KB
MD5

a626fb7a89ab42f2a70643a2374e9818
SHA1

3c8fbc0e5ff744c620cdaa40e3d4976efd643af2
SHA256

4bfd4f372b542147b9e20f49ff1e48e4ada86ec4670603d190d351891e8633b1
SHA512

948b7d5ebd5ac542cfe166076e1f55acc6a30c72274f206fca8dfb1b7a8b35dd69a078695da6905b264056927ccd17e4e5010366abe6d000831ed0ee1fb18ad3
SSDEEP

3072:/M5tx90DKWXIckX/if/FctEE2y7IumrS078XJ/svOt/LgVdaW:WzoKWXu/ifCiys58xsvmg2

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2940-13-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2940-12-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2376-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2112-80-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2376-175-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2940-13-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2940-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2376-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2112-79-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2112-80-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2376-175-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2940	2376	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe	29
PID 2376 wrote to memory of 2940	2376	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe	29
PID 2376 wrote to memory of 2940	2376	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe	29
PID 2376 wrote to memory of 2940	2376	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe	29
PID 2376 wrote to memory of 2112	2376	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe	31
PID 2376 wrote to memory of 2112	2376	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe	31
PID 2376 wrote to memory of 2112	2376	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe	31
PID 2376 wrote to memory of 2112	2376	JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a626fb7a89ab42f2a70643a2374e9818.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\821D.129

Filesize
1KB

MD5
781bc6a196f0c15f552e1192ef00672f

SHA1
6b23d343c68a944216215a61ca2481ba6ca02b3e

SHA256
84e867883f265b2a26b581dbd6808ff65b43ce19a030c426d375402edad2d56b

SHA512
acbcf095250da0311144739978cd4b281dfd5cad0bcf847b218ac8b6c9fd0f46958dd555b39222eb78b34b1e98f53a460ba20113cb5157f56b5ea7034f4673da

Download Submit
C:\Users\Admin\AppData\Roaming\821D.129

Filesize
600B

MD5
8e9b9fc33b791e0b1a0f717d59ba8e57

SHA1
2426bb97040727e9c873a7dd654f6ed947b5c8ba

SHA256
70c4212cfec461fa5cc4f02ead5f713a5f807d7af3b0422f93fab7377c049605

SHA512
77afbde698e52b641e04d0ad53c17a351b03cfa1901efcf6a15af17f3bef3a21ed02f3c32c358f460b17de7cbfdc844eda6138c1ed646e61ca1910611b42ceb2

Download Submit
C:\Users\Admin\AppData\Roaming\821D.129

Filesize
996B

MD5
25df6182801fcc9d39aa0a903104b02f

SHA1
1ab27f5686850c70c26f031ce6bae16568b235b6

SHA256
02e09b9904b9145fefbfa6ded0a15bbe0159c568e5cd149474d39db00f063aea

SHA512
5fd224806afb68e527b27e91cf8b89e17a04a99e3eba9c0fcb54be9cb9909cf1524e0d3bf4391aa833bcb08d990540484b817ce9f1dd2504c334dc6087baf0e3

Download Submit
memory/2112-79-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2112-78-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2112-80-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2376-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2376-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2376-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2376-175-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2940-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2940-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing