cycbot | 72f72c3e0f03141457b26f024e563f0c016e71859e457fd453aa9b205c549dc7

General

Target

JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe
Size

180KB
MD5

ac71b972ca228261e80224b728710bf9
SHA1

90a335b7c3d543f2de640a2f7bca59158942d462
SHA256

72f72c3e0f03141457b26f024e563f0c016e71859e457fd453aa9b205c549dc7
SHA512

8461fa2dea50f6007b845be5a33e499274e4e23f7866b5c4ae0339e9d4898a9389ed056767afd2d9db43ec6d2616b1af4f68638678b0b914ef943f16fc3999ac
SSDEEP

3072:WxYD/9ctwl0gYjQFIRW1hl0M6MuA+vhrodZyKaRZnIW5M1ZjLIc4Bz:+acPAIRW1hl0Mpu9vFKYKqIWQjLY

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2884-13-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2884-8-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2548-15-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/3016-82-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2548-153-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-2-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2884-13-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2884-8-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2548-15-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/3016-82-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2548-153-0x0000000000400000-0x000000000046B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2884	2548	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe	30
PID 2548 wrote to memory of 2884	2548	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe	30
PID 2548 wrote to memory of 2884	2548	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe	30
PID 2548 wrote to memory of 2884	2548	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe	30
PID 2548 wrote to memory of 3016	2548	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe	33
PID 2548 wrote to memory of 3016	2548	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe	33
PID 2548 wrote to memory of 3016	2548	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe	33
PID 2548 wrote to memory of 3016	2548	JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac71b972ca228261e80224b728710bf9.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\48B7.E5C

Filesize
1KB

MD5
025e3d5647a190541c47894157eedd1a

SHA1
fbbdbb6a9ac0347636effa017bcc4ee82788c846

SHA256
6dabef404d9f3aaace0a66839e0c65d335f475552cf428aac8bdd4d7559e7798

SHA512
ec950839b45b5eba810ebc3ac770e7c82505a2f30f8f9bfd711e81f2afdfd3bb8ef57c25077a1e439871a6726440f02869bad9cc98955128b866a4d73b036e49

Download Submit
C:\Users\Admin\AppData\Roaming\48B7.E5C

Filesize
600B

MD5
f44307c78b653ab56686b4d236290eef

SHA1
7a08035042427e57d48dc9be2e2dad9516e72d16

SHA256
eea5571d7a5577d5fc6688bbf7b6d99bd91586118465d56593d6f13c4726fd64

SHA512
d9c218df320e0342038c8ab33d8c6bd792777467b21fe6a3c52c087a38c1113f7322ae8ee1b9cb1090c563f4d899f8d9617958fd0a9251f3be941a4339993c56

Download Submit
C:\Users\Admin\AppData\Roaming\48B7.E5C

Filesize
996B

MD5
ca78b0daed95e4258456dcf76dcfa246

SHA1
2efce72d63f0c63386eb72a6ee73ba08b054acfe

SHA256
93e78a3fdbf2b8031d2fdff95722b2963cf1a7ca4622f4188ee5dcdbad6f99fe

SHA512
c591f83f373e24a2e291806e0d4f4d646085ca6d3752a6783ce72f1d64bee3b4597e9c423be1120fba58f6377da3a4102765aec8636b4d861b0a483acc73c2f1

Download Submit
memory/2548-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2548-2-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2548-15-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2548-153-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2884-13-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2884-8-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3016-82-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing