cycbot | a2f7ee5299a2486d20c1624d23deb7ca1aad59225bdf7f22f5d96e61da72bd43

General

Target

JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe
Size

180KB
MD5

4fa5203958314656a26d1626a2c613bc
SHA1

3a634b9ff4f19eac98cd39e0e6d4c1695fba5336
SHA256

a2f7ee5299a2486d20c1624d23deb7ca1aad59225bdf7f22f5d96e61da72bd43
SHA512

44521de2fabba707725bbe4e50ca26ee2999b65d0ed2fa0b292646345b0a5f5f24c4c3a06f33bea0c7b5551b2c2cfee6eaba7206b893e21bd94c75364db398c3
SSDEEP

3072:/puRDgiR7PBt/kUhFo9/HluGY0PWI62Gj9jcrCxB8G+lyk4UTbsji9Ks+W57pP:/KRPn/kUw1HUGzXQj9QmxB8blyr0bsjq

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4848-16-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4104-18-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/4104-19-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4528-129-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4104-308-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4104-4-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4848-15-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4848-16-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4104-18-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/4104-19-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4528-126-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4528-129-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4104-308-0x0000000000400000-0x0000000000454000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4848	4104	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe	86
PID 4104 wrote to memory of 4848	4104	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe	86
PID 4104 wrote to memory of 4848	4104	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe	86
PID 4104 wrote to memory of 4528	4104	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe	89
PID 4104 wrote to memory of 4528	4104	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe	89
PID 4104 wrote to memory of 4528	4104	JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe startC:\Program Files (x86)\LP\54B8\472.exe%C:\Program Files (x86)\LP\54B8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fa5203958314656a26d1626a2c613bc.exe startC:\Users\Admin\AppData\Roaming\83B46\3DD54.exe%C:\Users\Admin\AppData\Roaming\83B46
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\83B46\6A05.3B4

Filesize
996B

MD5
7fc276b8e2a2d871a19d35f3998cf2e2

SHA1
fdbf31659f63c56703cad13cd7fffc22d8d7f8d0

SHA256
d96b78a35ca6aec668f596c22fe740cf7e7b55d8591572fda4bdc8b15b2fdc1a

SHA512
8d82471c8990176965bc486e47b410fceedb4c0c0dce2b9d22eb22a6b6b43d6c83688e3cc484e9d3133e97e38f7a1c5e6bdc049f560ac0de790bb555c2ca96ed

Download Submit
C:\Users\Admin\AppData\Roaming\83B46\6A05.3B4

Filesize
600B

MD5
5951a2526edb0838a35c50ad6f2a3a7f

SHA1
b9cf419ea0fe0699c83b29a042d1eab41c0a6948

SHA256
edd29700fdcdd9a0905f8a37476ea15a6a47e4a383bff4900454716d2516f0fa

SHA512
50e1e85a59b8f4134c32492b66d54143e7159fd2cd190d0a837358af3e8b3744cee0a3001a9d528702f4c6204723d422d1ec2a447227eeb0c4393cafa47a0d75

Download Submit
C:\Users\Admin\AppData\Roaming\83B46\6A05.3B4

Filesize
1KB

MD5
a405131cdbaaa705606f01de2b98d6fc

SHA1
bb41ab382f6feb71d361dd42957666dcfc785994

SHA256
c543954d9ab127f4a6431cc406692d181dfc7f4d735549e59f9d6c9d0614a9a3

SHA512
50eb15ac7467349d693e55d0845ab63fd4a9f9aa4943d34281a27acd8e5fd416898d49398854ff6361f34fedc54b14f6ff21977bdbcc0cead308480dd1683132

Download Submit
memory/4104-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4104-1-0x0000000075920000-0x0000000075959000-memory.dmp

Filesize
228KB

Download
memory/4104-3-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4104-4-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4104-309-0x0000000075920000-0x0000000075959000-memory.dmp

Filesize
228KB

Download
memory/4104-308-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4104-18-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4104-19-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4528-126-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4528-124-0x0000000075920000-0x0000000075959000-memory.dmp

Filesize
228KB

Download
memory/4528-129-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4528-128-0x0000000075920000-0x0000000075959000-memory.dmp

Filesize
228KB

Download
memory/4848-17-0x0000000075920000-0x0000000075959000-memory.dmp

Filesize
228KB

Download
memory/4848-16-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4848-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4848-13-0x0000000075920000-0x0000000075959000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing