Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe
-
Size
196KB
-
MD5
d07dfbace8efa05eb416c64a6908c0d9
-
SHA1
4b471857353e0789d12f15ae0af2f75d54a641f9
-
SHA256
1e12cdc2d7a63329f90c97970e605bc13468f6dc9ef7815566c1594177309c0a
-
SHA512
839a0573aab4873d70b084c12105231242a82ed732bb2b681d5ea5e3066c2cdd2d02226e8e361fd0f621bb4f379d844da97aef8350e7dba9aeefc9217486f07b
-
SSDEEP
3072:6OQi1NlA7wKJlAsCK9l6T1C5In0IrycK9Ekj2tD9mKg1+3+XPTUgqmMKsoO8aJtB:b/1vrV+l6TAOnjryc5rNAlU3+biiU60
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 4 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral2/memory/5032-9-0x0000000000400000-0x0000000000454000-memory.dmp family_cycbot behavioral2/memory/3636-14-0x0000000000400000-0x0000000000454000-memory.dmp family_cycbot behavioral2/memory/2004-83-0x0000000000400000-0x0000000000454000-memory.dmp family_cycbot behavioral2/memory/3636-189-0x0000000000400000-0x0000000000454000-memory.dmp family_cycbot -
resource yara_rule behavioral2/memory/3636-2-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/5032-8-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/5032-9-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/3636-14-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/2004-83-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/3636-189-0x0000000000400000-0x0000000000454000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3636 wrote to memory of 5032 3636 JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe 82 PID 3636 wrote to memory of 5032 3636 JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe 82 PID 3636 wrote to memory of 5032 3636 JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe 82 PID 3636 wrote to memory of 2004 3636 JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe 83 PID 3636 wrote to memory of 2004 3636 JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe 83 PID 3636 wrote to memory of 2004 3636 JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53cd462fa5f9504135fb0af2fc00224ef
SHA11ccd672e8cfb3a5396567e817cccb9c96ccc4ed3
SHA2565628e9167c750d9175cd30d171364c4b05e317d969a070d0eefdee848ae911ec
SHA51200d21f36c4e556fa8b1cb6073a80499aaba2fa1ff922dbe6227a946537e9faa3abc6fb8823b71a4362b671c9c3d73b978f080f5ffe14564660fea869b02c3492
-
Filesize
600B
MD52f42815a584c6394b3d3b6ca4ac9d27e
SHA17fc1e8424334794910bbd64c22f7515462d8a8cc
SHA2564dcff8b8a7baccece1c93e8001dbcfc054041a2e2729288a2fae339f9dc06388
SHA5123f0b9a6fe0a6b8e11ad23b1be614cce7b73548a8c614f7d0fad7f355f423a33016e148f6d9237b9abec17b14affcda25bb65b70de70b6467dfc312c9151e696f
-
Filesize
996B
MD586084a1db1f97fa51b42c5f390cf71a9
SHA19e96e9d804d7d4f257f9f9a00aef38c0aeca8727
SHA256017187ef810049b5305bd21312819b040755f01fc96e859e0e74b234c7616391
SHA5125a3b898ef91374743cd18e8fa1f24e15ab75cc98325edd497bc39355332b22febc60a5d6f2036454d6a0e7feb23043ffb3e75288d7e95ef9c78f4ed54bb898db