cycbot | de2e807d902c20c4b832ae7468c4476719ade6e94e52e60e5516aaeaf77df2e4

General

Target

JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe
Size

220KB
MD5

03e143b7c0348b48b9825d3f035c24cd
SHA1

c430a6cedf9c349403e53bc846a9af0ba0974ce4
SHA256

de2e807d902c20c4b832ae7468c4476719ade6e94e52e60e5516aaeaf77df2e4
SHA512

cce9881355d2117c6701fb06b6bb709c3865423ce4036389bb6e1f146ba6b5bc5f8daafb5a1ebf49f85bfdc23f2f7e719e42f86b23a6f5a1c74ca8113dae9f8c
SSDEEP

3072:KdoCyyrXcOllv/VZfk9picQwdd6y2c1r0xIhcxcLwg+8QfTqedzAiq+hQyQHxsgZ:5C7rM6l8pX7dpF1gxPxU+8RedJHQvHy

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2820-7-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2112-15-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2460-72-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2112-188-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-2-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2820-6-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2820-7-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2112-15-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2460-72-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2112-188-0x0000000000400000-0x0000000000469000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2820	2112	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe	31
PID 2112 wrote to memory of 2820	2112	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe	31
PID 2112 wrote to memory of 2820	2112	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe	31
PID 2112 wrote to memory of 2820	2112	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe	31
PID 2112 wrote to memory of 2460	2112	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe	33
PID 2112 wrote to memory of 2460	2112	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe	33
PID 2112 wrote to memory of 2460	2112	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe	33
PID 2112 wrote to memory of 2460	2112	JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03e143b7c0348b48b9825d3f035c24cd.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BE63.438

Filesize
1KB

MD5
647f6a89c1a26f0c5f959cb0c7b66c79

SHA1
e40ce5c277345d13b6092f7b3da8abf4bf405319

SHA256
1da94466b87ac3834a8c35a3087d33d404c65ff3ac4f87ca00e3cdfde59f2a53

SHA512
88300d57e8a7ffc979bd8c917d78286b197f86e02e867da3a1443de5404aba3d11467aa8687945317821763f321c56b8ce61746186579e86209a2ceaf70a6efd

Download Submit
C:\Users\Admin\AppData\Roaming\BE63.438

Filesize
600B

MD5
7eaec3a90c2a34823fbc6a57869b131b

SHA1
0eb73dfaa6277b7a4e12db34869456e7596f4007

SHA256
c3516e7003b07652a513e2dabb255b1e5874991195d7c4bc81da5743b7dcced2

SHA512
4456fa7445e890b8976c824e5095363ba1a3834be713ba4516a0b13b59d12d1fdf6e85404751e48a0e970c49e82c8a3fce40b8daaa176303abbc4a83231d5623

Download Submit
C:\Users\Admin\AppData\Roaming\BE63.438

Filesize
996B

MD5
376e56529afa2dec2a6e8dff206e7696

SHA1
cfc3d8bc3d6e17d55b533b64ca0f13ad04fc24d5

SHA256
745b64d8eb896a7830f47c90535a6b3ab875bfb47ea36f081d9156e07edd09cc

SHA512
aa47933c2a7a2c83fe57493dcc856d162b09d9d113e1484dea565dd63fae5067db02714d37dffac5779655357f4201325062f7bd75ca6c3d3dc95ef585ff685d

Download Submit
memory/2112-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2112-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2112-15-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2112-188-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2460-72-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2820-5-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2820-6-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2820-7-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing