cycbot | 56277931f12806163f3156ef21934697889543ab1b42ae9f102890f756ba38b4

General

Target

JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe
Size

184KB
MD5

594a3e0b12474de4d6ee6b0875963ca3
SHA1

441cfa3d7f4571b451fed7c0d0337347068e6d33
SHA256

56277931f12806163f3156ef21934697889543ab1b42ae9f102890f756ba38b4
SHA512

d9d51f0385a33d16ef9706547b9f036f4eff7101e46bba8c706d48383a389b78022796df0f9a4ba44b31f22cb32c7ea6c723ab183b1a881a8d5918a69ad57c39
SSDEEP

3072:QlgL/uXZ2Vt8+hokXG82qtophyr/pV7EW6vlRMynaW8kzwqpewitA2ZRCJ0lyWVh:QlG/AudnGdPyjqvlmynaocqpewcNZS0V

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2184-14-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral1/memory/1736-15-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral1/memory/1316-82-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral1/memory/1736-185-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-1-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1736-2-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2184-14-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1736-15-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1316-80-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1316-82-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1736-185-0x0000000000400000-0x0000000000471000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2184	1736	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe	30
PID 1736 wrote to memory of 2184	1736	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe	30
PID 1736 wrote to memory of 2184	1736	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe	30
PID 1736 wrote to memory of 2184	1736	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe	30
PID 1736 wrote to memory of 1316	1736	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe	32
PID 1736 wrote to memory of 1316	1736	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe	32
PID 1736 wrote to memory of 1316	1736	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe	32
PID 1736 wrote to memory of 1316	1736	JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2184
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_594a3e0b12474de4d6ee6b0875963ca3.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\593F.D70

Filesize
1KB

MD5
16b8cdeb0a76710453c69261e591cd78

SHA1
3652f57716435cc941803f87e6bd60262efbd9e4

SHA256
1d65c581d4017ffb13a9cb4ad9c31127280cb7f6ba8842b1f893e586b8e9e05d

SHA512
5d59dc7fd08134a5ecbf19af846d3a36851a6e3645bcea722f3edd35b87370163120166ee76ef02ef8465dfb60314e5dd48fc6bc4342abee85197b91d709e312

Download Submit
C:\Users\Admin\AppData\Roaming\593F.D70

Filesize
600B

MD5
0a2d2a66588311a032325bbcf2aba714

SHA1
67bbd7ade00a9f2d40101bf29642931bd73259a7

SHA256
813b5fc6d3ddbab6fe57f7bcfa3544e3e4e698a26c9e6158357ece93645de3b9

SHA512
1325ac9a91ff79d2f47a7687bd5b58338ec1cdbcd3d892fe8fbd528de08203ac1fb36648989c073c10f53056eebe6c606e8d4589853cfab3eef26be84bfb7d76

Download Submit
C:\Users\Admin\AppData\Roaming\593F.D70

Filesize
996B

MD5
deca2208590598b9785afd0ec2ecc604

SHA1
84b1a8d82b499b3f87fd19c7e4df692579942691

SHA256
408b17ae4b774bfe3a1082e68113285f4bbd8034e50a1330cf941a5a90e2430f

SHA512
2c9c0bfb777495e88ba240a338e82ec5b4b07cc84f8970cb2939040b6ceb8a30c3456ba664ced83fd0158d6826aba45a129e087823caaa54a7e308499738200d

Download Submit
memory/1316-80-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1316-82-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1736-1-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1736-2-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1736-15-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1736-185-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2184-12-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2184-14-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing