cycbot | 1146a8a501bb15ab962709fe7cf7412783692f1790e5cc1a7c7e9455d578340f

General

Target

JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe
Size

183KB
MD5

3acbe8b3b4a9b861d3121f968a39221d
SHA1

696f4af5883462ac645f0e157a17115e940ad235
SHA256

1146a8a501bb15ab962709fe7cf7412783692f1790e5cc1a7c7e9455d578340f
SHA512

3bdcd19910ea07808d2783271ffb28b4866163c6cdad5cc4556ed392b4f1cfc1ca15dd1a9797066c1a59eb6024e1dd4dbb53876ce6ac07f52ae2c7af41191930
SSDEEP

3072:qZtHuTHOHlkFxFPijo5oDQH43NvYDElLhoAC8276VeoOURL9d4Se4wyahb3W:Q0TxxFQo5oDLZYDELgx63LRL9d4SepVI

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1732-7-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2400-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2736-71-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2400-182-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2400-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1732-6-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1732-5-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1732-7-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2400-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2736-71-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2400-182-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1732	2400	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe	28
PID 2400 wrote to memory of 1732	2400	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe	28
PID 2400 wrote to memory of 1732	2400	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe	28
PID 2400 wrote to memory of 1732	2400	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe	28
PID 2400 wrote to memory of 2736	2400	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe	30
PID 2400 wrote to memory of 2736	2400	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe	30
PID 2400 wrote to memory of 2736	2400	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe	30
PID 2400 wrote to memory of 2736	2400	JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3acbe8b3b4a9b861d3121f968a39221d.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F6D1.067

Filesize
1KB

MD5
474ddda055e52cf2d5706fa46206faee

SHA1
ec71e3cd44230f967aaca0722aa8614802770b25

SHA256
e9fa85384d6c905a5ffe16f894564c5511fd751cfd120443301267efbe53f840

SHA512
be7f5b9712a57775d85217a1b7d06f84fd7d9de2b44649e1775722f0e5260cae23266d060bb65db4530289b6f798c253dc2383535a6fe9baebb77245c6a251fd

Download Submit
C:\Users\Admin\AppData\Roaming\F6D1.067

Filesize
600B

MD5
3de6a35f07c88a8636bd6b1ce8bc413d

SHA1
1fed5918e7c69c6ec4d33adc84860e66f6211c2b

SHA256
d7de91647c499a32fd1596090d93582ac49b809a7bbb2eb11bf6b07d51b03768

SHA512
0b1805e469635409adb748d8d1ea960b905be7580bbd8570d5aa926a91c04dda552482f3b7a6feea531013106f58e6efa9c519104cb2a55bdef5d19b536100cd

Download Submit
C:\Users\Admin\AppData\Roaming\F6D1.067

Filesize
996B

MD5
f4c2b79eda185d8b6afc27b519d642ec

SHA1
2d398a05e263313852c837b6a03262b293d63f62

SHA256
25905d538e87444d5d7734b93764ff330cd1fe252c59cbf1be1f76564aded50d

SHA512
2001f9b7dc85178903170519c5bcc52da9f096ea7d5691122dee161d42ebe3af28bb3acc481c43e4f4bb0e75180fbb779d513cc42beb92dcf974c231c940d151

Download Submit
memory/1732-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1732-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1732-7-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2400-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2400-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2400-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2400-182-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2736-71-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing