cycbot | 1381af938213a1e33bb5cd9cb1fa82d2cdd5f14e0a53edcdb7480847277bbd71

General

Target

JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe
Size

170KB
MD5

bffa6c7ebd4fb86eba73b01b96cf8a3c
SHA1

7ac7f718962660df5542de75128871d420df4aea
SHA256

1381af938213a1e33bb5cd9cb1fa82d2cdd5f14e0a53edcdb7480847277bbd71
SHA512

fb41a3acf84424fbfb04546bf88bde697927f96d26df4344e7ce518f8c7c72e1b2c4d74b84596d6209806ebe006ca2c5af2e00d37260d7994251c0629e85ac9d
SSDEEP

3072:6iGifTBzP8Yxv9OuabnFezAu5INkmzasdh3p6CLYb5eelB+vs4:vNV7tq5ezp2zF33pW5eelB+

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2804-14-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/3040-15-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2084-88-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/3040-203-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3040-2-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2804-12-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2804-14-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/3040-15-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2084-86-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2084-88-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/3040-203-0x0000000000400000-0x000000000046B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2804	3040	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe	30
PID 3040 wrote to memory of 2804	3040	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe	30
PID 3040 wrote to memory of 2804	3040	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe	30
PID 3040 wrote to memory of 2804	3040	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe	30
PID 3040 wrote to memory of 2084	3040	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe	32
PID 3040 wrote to memory of 2084	3040	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe	32
PID 3040 wrote to memory of 2084	3040	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe	32
PID 3040 wrote to memory of 2084	3040	JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bffa6c7ebd4fb86eba73b01b96cf8a3c.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D9BB.175

Filesize
1KB

MD5
29a001295f9ed4f4fbf8eec2cd380409

SHA1
a10cca00ca653f41c3041cf0fb01ea6cb79aa99c

SHA256
0cf0db982d1d4c59f52770d1533fbcf6b50a5f318eab2bec8239cad20ec243a0

SHA512
8231c4c3b7e1187e1c647b5d2181a3ff3c0bfdbafd6f9370aace31a79f306feccafccc1fd26465a00242045a6cf92bfdede6a466eb9649bf03f00dfbfdb2d3bd

Download Submit
C:\Users\Admin\AppData\Roaming\D9BB.175

Filesize
600B

MD5
24d6b4fcdcbd7c474348517fa8efd0da

SHA1
0ba474b4b545d6f9c938d74c815a44924f80a097

SHA256
adee219bcbc860917510089cf9096cb28884b0dd87961d3a6417c65518e7bf45

SHA512
a28aa4689be717ecb1461c7f5b38125281c730b91809af1c89acc2bcd2475fe05884f653bfeaa410d4f2a420a9c0c84e79be096af2424061b6989b57d9079aa0

Download Submit
C:\Users\Admin\AppData\Roaming\D9BB.175

Filesize
996B

MD5
5fe3fa5beb1ae07838665ab963dde1ac

SHA1
36a48301d0d8acf3daf79866e0ba7259cde09e58

SHA256
9def5d593b74d3b9c8f0d342eee061376f0669d688129b8bb07538f5aee17126

SHA512
ddbdb3a49568eae4a7c2a70b1f66b2f7c71cf05119cebd65976a64bee35ce55c93ca130b19f7f68bd41be474ff96868add7e6c25909b7a5b3545bf29834f6beb

Download Submit
memory/2084-86-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2084-88-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2804-12-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2804-14-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3040-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3040-2-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3040-15-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3040-203-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing