cycbot | c23b2b9e37ca7062ce5e975ea50b81dd136cec34cc3fb7a14d9e1e28b133a2c4

General

Target

JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe
Size

189KB
MD5

4cb7590e0e07834d25be684deedb5440
SHA1

c52f77615830cc56fd7d354033d75131d1283f49
SHA256

c23b2b9e37ca7062ce5e975ea50b81dd136cec34cc3fb7a14d9e1e28b133a2c4
SHA512

f5bf4a2b6d8589b0a0fedcd65719fc7ce1610b1c4a32ccdf98e81c7da58058b71e859038a46f5d0ce23daf2bcf8967f23a3ea1812317ed0f42c9fc413e47db05
SSDEEP

3072:Zr5sGc9Is8hmilTGRKLNOdZG6/SvatrB1s0eSvrRCQ45RvgXahmSCIPREKwyuNt:nXVG84TTKvo9PjD8VgXahmX0jwyc

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1640-6-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/1640-7-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2320-16-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2668-78-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2320-182-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-2-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1640-6-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1640-7-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2320-16-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2668-77-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2668-78-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2320-182-0x0000000000400000-0x0000000000469000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1640	2320	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe	30
PID 2320 wrote to memory of 1640	2320	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe	30
PID 2320 wrote to memory of 1640	2320	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe	30
PID 2320 wrote to memory of 1640	2320	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe	30
PID 2320 wrote to memory of 2668	2320	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe	33
PID 2320 wrote to memory of 2668	2320	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe	33
PID 2320 wrote to memory of 2668	2320	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe	33
PID 2320 wrote to memory of 2668	2320	JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cb7590e0e07834d25be684deedb5440.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FF65.992

Filesize
1KB

MD5
31285133a1245158606665cc743911d6

SHA1
5c014a50becaf1e6f21ce2df15ba0ddf1588202f

SHA256
6090553aef805144bc5e8fee6427019ee129dfb5ea02e59d02bd57679c7ce4c8

SHA512
624122b5a8f55febf8b6a1009e0766826835e0cc34cf5d62e1d7b5adf48d619acc88a324ff50e90f6597e1e9358c9be8fb58a9201a7d6d308032d42606a4caa1

Download Submit
C:\Users\Admin\AppData\Roaming\FF65.992

Filesize
600B

MD5
a2120b8f017a99d1ddbe558f2a7289da

SHA1
2b820511794e1c87f934bc61128566af032c6966

SHA256
3e106ecff515688741cb2dfd68eba6680e59cdae980679904f32e73b52c82a41

SHA512
eb1241fe66a870726a028645482183fc5dc4e398b8dbb1511311a6715491e7b8d9a7a83af2ec63e564056ff0f5411a94fead3ce0b00fadcd06aacbfb89caf6dc

Download Submit
C:\Users\Admin\AppData\Roaming\FF65.992

Filesize
996B

MD5
cd58c20056e339b2e76ca8bdeb54e9b4

SHA1
397c3f86a419cce2a1728051f05d0c6394c97c93

SHA256
58dc79aaf2e53d7a324061a3877d4cf23b2506e2be77dda37941b6891346801b

SHA512
5901e118940d6f398e9949f48be5953b26cee9bbeeafa738709fc90e224f79bff7056905dd7cddc9b472dc172d172850c1116dffbae83bd8fd1a3f340162bd17

Download Submit
memory/1640-6-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1640-7-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2320-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2320-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2320-16-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2320-182-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2668-77-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2668-78-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing