Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 19:09

General

  • Target

    JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe

  • Size

    196KB

  • MD5

    d07dfbace8efa05eb416c64a6908c0d9

  • SHA1

    4b471857353e0789d12f15ae0af2f75d54a641f9

  • SHA256

    1e12cdc2d7a63329f90c97970e605bc13468f6dc9ef7815566c1594177309c0a

  • SHA512

    839a0573aab4873d70b084c12105231242a82ed732bb2b681d5ea5e3066c2cdd2d02226e8e361fd0f621bb4f379d844da97aef8350e7dba9aeefc9217486f07b

  • SSDEEP

    3072:6OQi1NlA7wKJlAsCK9l6T1C5In0IrycK9Ekj2tD9mKg1+3+XPTUgqmMKsoO8aJtB:b/1vrV+l6TAOnjryc5rNAlU3+biiU60

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 4 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
        PID:5032
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d07dfbace8efa05eb416c64a6908c0d9.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
        2⤵
          PID:2004

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\34E0.B22

              Filesize

              1KB

              MD5

              3cd462fa5f9504135fb0af2fc00224ef

              SHA1

              1ccd672e8cfb3a5396567e817cccb9c96ccc4ed3

              SHA256

              5628e9167c750d9175cd30d171364c4b05e317d969a070d0eefdee848ae911ec

              SHA512

              00d21f36c4e556fa8b1cb6073a80499aaba2fa1ff922dbe6227a946537e9faa3abc6fb8823b71a4362b671c9c3d73b978f080f5ffe14564660fea869b02c3492

            • C:\Users\Admin\AppData\Roaming\34E0.B22

              Filesize

              600B

              MD5

              2f42815a584c6394b3d3b6ca4ac9d27e

              SHA1

              7fc1e8424334794910bbd64c22f7515462d8a8cc

              SHA256

              4dcff8b8a7baccece1c93e8001dbcfc054041a2e2729288a2fae339f9dc06388

              SHA512

              3f0b9a6fe0a6b8e11ad23b1be614cce7b73548a8c614f7d0fad7f355f423a33016e148f6d9237b9abec17b14affcda25bb65b70de70b6467dfc312c9151e696f

            • C:\Users\Admin\AppData\Roaming\34E0.B22

              Filesize

              996B

              MD5

              86084a1db1f97fa51b42c5f390cf71a9

              SHA1

              9e96e9d804d7d4f257f9f9a00aef38c0aeca8727

              SHA256

              017187ef810049b5305bd21312819b040755f01fc96e859e0e74b234c7616391

              SHA512

              5a3b898ef91374743cd18e8fa1f24e15ab75cc98325edd497bc39355332b22febc60a5d6f2036454d6a0e7feb23043ffb3e75288d7e95ef9c78f4ed54bb898db

            • memory/2004-82-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

            • memory/2004-83-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

            • memory/3636-1-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

            • memory/3636-2-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

            • memory/3636-14-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

            • memory/3636-189-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

            • memory/5032-8-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

            • memory/5032-9-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB