cycbot | 0e0198d572c692a1ff773304b76adb8a5324973440adcbd9bd27ca33e21a2a9c

General

Target

JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe
Size

193KB
MD5

3bf2de5fb77f3c12f9daf73b8932578e
SHA1

83754d29ae8545542c7e1aae7a8d84f1ab438061
SHA256

0e0198d572c692a1ff773304b76adb8a5324973440adcbd9bd27ca33e21a2a9c
SHA512

a69e995c753b35549f05771d2546ca6d39fec11a4e23cb511a433fcf39f1a906edc2ba99120337eebbd7e7bf30ba7ad5b5a5593420ab8562b8c02ae5e1d19b45
SSDEEP

6144:Zc0aJNoMmODvgFsf1ERArFLF+GsLvXvlx:60aJN4evgFKyABLFit

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2760-6-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2392-13-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2128-75-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2392-163-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2392-200-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-2-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2760-5-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2760-6-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2392-13-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2128-75-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2392-163-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2392-200-0x0000000000400000-0x0000000000447000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2760	2392	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe	30
PID 2392 wrote to memory of 2760	2392	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe	30
PID 2392 wrote to memory of 2760	2392	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe	30
PID 2392 wrote to memory of 2760	2392	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe	30
PID 2392 wrote to memory of 2128	2392	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe	32
PID 2392 wrote to memory of 2128	2392	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe	32
PID 2392 wrote to memory of 2128	2392	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe	32
PID 2392 wrote to memory of 2128	2392	JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3bf2de5fb77f3c12f9daf73b8932578e.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\233B.BAA

Filesize
1KB

MD5
594a65ccc5b241d1c8381e4f6023cadc

SHA1
c4bc7aafacded43b6ed044e8134a53c43ebce04e

SHA256
8ad72af26155297b784cd55a4f0d20e3b080d6a5e7d5ed13ad10fef8b66a8fd3

SHA512
45a56e6ebf1d399b08b3f77f49daff5dd298b844f63a4e7a7a03358e15b29c3e49a2f708e5b367b38ba14b697c1f8916ebe8b9bfc015c847791c36e0718122f5

Download Submit
C:\Users\Admin\AppData\Roaming\233B.BAA

Filesize
600B

MD5
59d10a66fd4b989ab12e2a3a0b506007

SHA1
ae37f3ab6d4ecdaa6a420a48115a00b37c976bfc

SHA256
51efa4fd9a9e18fbdf094f1226d11c5182a97a0e40a371e0761d0de002732edf

SHA512
6cd2f952bc4ac1f6389ae0d7045083c769d4a6c360f19742aa591f5c7fab953b4042f659b128ffe3adf52561f751077f2c7c554a36c629820a734e0389809b0a

Download Submit
C:\Users\Admin\AppData\Roaming\233B.BAA

Filesize
996B

MD5
ba9bdc5e85ff0989b873796159f99bb1

SHA1
5ad6b84c9de45fe1ebedb56610ef2b90599eccef

SHA256
516fe6a2a6f8934dc3a7c7cb4ce1e6efe4caae1420e0ebea5f168df965c08b61

SHA512
7a589e61d3235b0fce0daa54745ca36da7032e063001354f7cdb02c7e6fe1e722c55b0f4132b3e7c24a4fa89aedf14a0b76e7126fd3f47c68584da8184100089

Download Submit
memory/2128-75-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2392-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2392-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2392-13-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2392-163-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2392-200-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2760-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2760-6-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing