cycbot | 2f17bb1742217a5bc0fe0d89044c4241f382bc56c2995fa319f94a08798afcd9

General

Target

JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe
Size

195KB
MD5

aaef7fd20c151a51263286b2fbcdabca
SHA1

2b9ff1fb63f440d02fe4d572ce9c1eb7a3c17ce1
SHA256

2f17bb1742217a5bc0fe0d89044c4241f382bc56c2995fa319f94a08798afcd9
SHA512

93ce7971dd68f5e4c7eb0f745daa559c409f2f3e0b8bf9e30e808d334f19ef2dad0707ef7443d93f9263cd7743cfcf1e334400366e5420602cdf725c95ddbf5e
SSDEEP

3072:EUVfW7yjVxXgXC3Xhq8OgbX2++2gX3mchQneB9FjycwO65uky3yJqdRh0e+9lpcj:ET+XgYXhq8OgTt+bn5vPFPk2dftwj

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2944-13-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/764-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/1428-82-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/764-177-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/764-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2944-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2944-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/764-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1428-81-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1428-82-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/764-177-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2944	764	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe	31
PID 764 wrote to memory of 2944	764	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe	31
PID 764 wrote to memory of 2944	764	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe	31
PID 764 wrote to memory of 2944	764	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe	31
PID 764 wrote to memory of 1428	764	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe	33
PID 764 wrote to memory of 1428	764	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe	33
PID 764 wrote to memory of 1428	764	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe	33
PID 764 wrote to memory of 1428	764	JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aaef7fd20c151a51263286b2fbcdabca.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\3F6C.C47

Filesize
1KB

MD5
fa1cbedb8c7e885b31248f3d61302866

SHA1
f27d8be4ab142beb0e126620add2f57d36e38bbb

SHA256
3081cfc21b7e6989bba0af44cdac7279de481c31117c518bcb05b90d8a238959

SHA512
f727f5e0003f4f57e7ac892a6b0e967640e83a34346a5b6786538636d40f243fe9df8645d133cf2208f9d81e9ee89d730547eb1346d0586aae68b4470e1a528d

Download Submit
C:\Users\Admin\AppData\Roaming\3F6C.C47

Filesize
600B

MD5
568929b6d83be4220d2e2cb642110da8

SHA1
728ee818120bfbf68967a29cc434a6d8b010505e

SHA256
5211e8f95b148e7279793e6e2f14c048a77fff9cfd9cd38a8cbdff9cbf97e5e9

SHA512
d0f010e8c7e1a37059130672bcf1c655275f76c93bcff26078ed6e3c8a3311e7417bc6be83a174c9ade19ce828b9782c21180427a455ebe1ab1a49207f26ab7d

Download Submit
C:\Users\Admin\AppData\Roaming\3F6C.C47

Filesize
996B

MD5
7302e5ea6677ee8548ed2c10297dbe43

SHA1
d81fd992cc02a1da92eaf4c9febbd03ed2ddcc3e

SHA256
8fa5453ab13a2397bdac0a38154e485b5cd28f5d1a1b4f3fcdf3300eef24ffd6

SHA512
4536bcc88eefe87a321c7b58e0ec8f78bb49b98245a6963dac11158f2ca729a3a314c977de334056369f4edc8822414211d111e8579b0ba3016395cd71f19613

Download Submit
memory/764-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/764-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/764-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/764-177-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1428-81-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1428-82-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2944-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2944-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing