cycbot | 22a6f9f299cc529bc0dec2fed19665973ea2bcdd863e252c52c0e32660e84257

General

Target

JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe
Size

181KB
MD5

e7197d2a6259cc318520a10de50c3a20
SHA1

e360189fef5bb2727bc143a898e8a075c949f3e5
SHA256

22a6f9f299cc529bc0dec2fed19665973ea2bcdd863e252c52c0e32660e84257
SHA512

b16138a457068c9f1c4dcb1ec06897653b9b30ae7ea658d06e130324ae2a7729ad2f5a055ae4f23ef198b623813567b2778f51f0b4ac04d8e0e8670dcf9e2002
SSDEEP

3072:IcAz/44tIR4ra5NUSKS8PaSwY+M5jrTe9GRluCFj7mk1kR/pqXziDk+x7HA+Kqv2:I5zwOIqcZ4aSwYtVl1Fnmk1kW2DkGDQX

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/1680-10-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/3832-15-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/3372-74-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/3832-174-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lvvm.exe	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3832-2-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/1680-8-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/1680-10-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/3832-15-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/3372-74-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/3832-174-0x0000000000400000-0x0000000000471000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 1680	3832	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe	82
PID 3832 wrote to memory of 1680	3832	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe	82
PID 3832 wrote to memory of 1680	3832	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe	82
PID 3832 wrote to memory of 3372	3832	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe	87
PID 3832 wrote to memory of 3372	3832	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe	87
PID 3832 wrote to memory of 3372	3832	JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe startC:\Users\Admin\AppData\Roaming\Microsoft\csrss.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e7197d2a6259cc318520a10de50c3a20.exe startC:\Users\Admin\AppData\Roaming\conhost.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4143.EC1

Filesize
1KB

MD5
38909229f25d3064ecb0b62689adfb15

SHA1
1e63a77d254820a307ce919b292bd1a84536bdc4

SHA256
dcc92b1fe5f6bb05164a84749d444100da7c0567c7a2665a0895b3120271747a

SHA512
44b25763ef7b97651177e4a908beac9abc7c332687cb76484a0c9a498d07ce78f323c7f172330ca45ca4a02a31511e0dfa468600375d4a394b346f84ba35b527

Download Submit
C:\Users\Admin\AppData\Roaming\4143.EC1

Filesize
600B

MD5
c8708c29dc6515696277551b9598ce81

SHA1
35b2f81010d51d88362d290a0ffe48e1e2f20e62

SHA256
d02d6b24be31bf3d0f19a380fcd672b4aa55d94268eba7c9d6aa10280a955c5a

SHA512
962e4ccabb3edc0d1d749055cd06a974595faf024e99a89396c32f09c80a28df5c8b09c798bb0043a3323efe04b270947a80f1a0beb4d8837aff51122a87a1b8

Download Submit
C:\Users\Admin\AppData\Roaming\4143.EC1

Filesize
996B

MD5
312d0bff2f19abf20374520ad6cf87f7

SHA1
70843a36be8ee5ecfb5286e7584ce8ffaae416d4

SHA256
09992937b27f17481b637b64603791537a67e03b86f46d7c0e6b0ab9f2cc7290

SHA512
d86d53395af3298cca60c29bc617194892c71384947e957a106cdc63cb429e0a7823d00b3f6cf2ae72ad8653999ab12ccabe1fd4020771a04f55b9d074402429

Download Submit
memory/1680-8-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1680-10-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3372-74-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3832-1-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3832-2-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3832-15-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3832-174-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing