cycbot | 21cc5b476fe27fbe9105e4e44ee354c768afed0a828e18a384095501405fc889

General

Target

JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe
Size

180KB
MD5

f843a82e405e34c62bfa2af47f4ee17c
SHA1

786e94810cdfb43c9dc86d890a056e80e9c08a19
SHA256

21cc5b476fe27fbe9105e4e44ee354c768afed0a828e18a384095501405fc889
SHA512

96a711c4476782049d924f6523efc605ef1f34603a5212672e715680a6e0440a5fdc305d8614796f8e6a0861795ddaa48f03d2d07745f6ca4108302585458d79
SSDEEP

3072:E+2BoZZVHE4oyNruTioUow7K7c8lL8Yl52kLrGn9y+AxC4Cjwotwc:E9UZBEmNQiVvetlxrG0pMnjw6

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4820-14-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/5020-16-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/5020-17-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/5020-301-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5020-3-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4820-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4820-13-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/5020-16-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/5020-17-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/5020-301-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4256	4596	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4820	5020	JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe	82
PID 5020 wrote to memory of 4820	5020	JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe	82
PID 5020 wrote to memory of 4820	5020	JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe	82
PID 5020 wrote to memory of 4596	5020	JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe	88
PID 5020 wrote to memory of 4596	5020	JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe	88
PID 5020 wrote to memory of 4596	5020	JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe startC:\Program Files (x86)\LP\2D9A\7CD.exe%C:\Program Files (x86)\LP\2D9A
  2⤵
  PID:4820
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f843a82e405e34c62bfa2af47f4ee17c.exe startC:\Users\Admin\AppData\Roaming\AC399\58F2D.exe%C:\Users\Admin\AppData\Roaming\AC399
  2⤵
  PID:4596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 336
    3⤵
    - Program crash
    PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4596 -ip 4596
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AC399\94E1.C39

Filesize
996B

MD5
d98fd49452de1b695d532686a977ef19

SHA1
6f795b15aae3461f5f7751ea5fd4ba183e84ef53

SHA256
36d9414e25c54a004f7ff4ed9d7afb5b48aac3ee1651e4469b9c7a737b6337b8

SHA512
83d9fdd5c4a000d4e7fd1fcd2fa3a8ec571e6d8079336f6aa992231708e0e7a2b9950a28e1152912cdb5060658af48e92ce1e318954930f9b5533679b87bd200

Download Submit
C:\Users\Admin\AppData\Roaming\AC399\94E1.C39

Filesize
600B

MD5
1e3995f36a5b6b4115db11dbb8c2b8a2

SHA1
65421ac46a9f816534f72daf087db081f1b26568

SHA256
4078994c6e71cdc91fbf4a82d44ba7af4999dd81198e274fdb9cea1f006d04ff

SHA512
1686226ffd39f9d84d45d30e119aa7de6cb79de8cbed9a8296b241ed72826ddf0818ccd5f9c8d720f37f430df8e32603b2449dac1415bf5bc2465c0b1345db8f

Download Submit
C:\Users\Admin\AppData\Roaming\AC399\94E1.C39

Filesize
1KB

MD5
adf059f79e5e9ad394cab3ee79aa6f21

SHA1
addb95e1e764e9e03b33721800e6dda1292f035e

SHA256
cea16e947473f75b8b4ed24e2ae4fdb7b8ef1c00cd3c5faa6bc28adcb3b17057

SHA512
b8e80e7bc01e80f99bcee82a91231e8da81fce9e53167b1e400b6a8b05e3be1954a4f6238c6358da7b56f54a2c3bfe01ac76d8851d07931201456232f5617b97

Download Submit
memory/4820-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4820-13-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5020-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5020-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5020-3-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5020-16-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5020-17-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5020-301-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing