cycbot | 6afd8279cd03cbd5ae3953cba4bcb956361e6cfc0ffde0a536c4ff6648e96dbd

General

Target

JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe
Size

185KB
MD5

b8a6eb54edb4571909829761bf053fc0
SHA1

4d922ae5c964e404915814801965231cabd1fbe2
SHA256

6afd8279cd03cbd5ae3953cba4bcb956361e6cfc0ffde0a536c4ff6648e96dbd
SHA512

e52348c21c0bf38873673b279cafe583c14da20173c691677e094ac9a140455151d67f0c3ba1c2393c31409847fdefa8c9211399818695de9c718f8cc73598d7
SSDEEP

3072:qEP9Y//xDNBb9brg7NOUn5dMm9wFuCSiGbTRMI85+3kKS62CnyB1ZEPY:qs9Y//rBdrg7NL56VN0K50kO2CnyB1Zg

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2812-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2316-16-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2144-75-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2316-161-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2316-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2812-13-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2812-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2316-16-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2144-74-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2144-75-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2316-161-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2812	2316	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe	30
PID 2316 wrote to memory of 2812	2316	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe	30
PID 2316 wrote to memory of 2812	2316	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe	30
PID 2316 wrote to memory of 2812	2316	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe	30
PID 2316 wrote to memory of 2144	2316	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe	32
PID 2316 wrote to memory of 2144	2316	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe	32
PID 2316 wrote to memory of 2144	2316	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe	32
PID 2316 wrote to memory of 2144	2316	JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8a6eb54edb4571909829761bf053fc0.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9129.E9D

Filesize
1KB

MD5
8cdb0d75a8e7d018d2251fa85b6a4ee7

SHA1
c35ac5b56b6d9d15b61adf9fccb32b0c998d14e3

SHA256
10317c3caf13607c66ca9e023eaf9fdcc3ed35b73ed9193bd9d7ac5f2045a37f

SHA512
e3a893536d7532db8f680287dfacd4d283fb0b5d034941de33f8ed04312e1c2bc90f14cbece0e2a94c1b3750342cd5c611c0f4f2d2d7a56238823d6dea849a8b

Download Submit
C:\Users\Admin\AppData\Roaming\9129.E9D

Filesize
600B

MD5
e14e5ae5fe1b32cbe9c9e4584137e5ca

SHA1
54ee48aac88099e359be8473eff22423121b5a33

SHA256
d9ea6dd147bb7acee41fe5d54e79106152dd9e0e90a33fb3e130256e8a6b43b2

SHA512
de533eaa6a4ab4bf8664a5d34c9c375e8f27e05da0d03d57bab24c19a34bb1120781fb721e9c2d842384cef16927ecbcebfa8d85be71eb201b448ea82a18b204

Download Submit
C:\Users\Admin\AppData\Roaming\9129.E9D

Filesize
996B

MD5
59bcbc6b81638aae40744605c3f1cb13

SHA1
56ccab0590f51ec129ef824495b464a6f7e7846b

SHA256
1c7f0ca8d48e7d802ceadc9de574d0cd800ea778b4133d00711bce86788025a7

SHA512
65c9e96ff5a8bb93b8261f2faf012ec090b1cd404650058bee97b1566b8a59205e2b58e9e3f9182534febea76cc8d446d4bedaaab70d018017b3073ade67fbd1

Download Submit
memory/2144-74-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2144-75-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2316-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2316-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2316-16-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2316-161-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2812-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2812-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2812-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing