cycbot | d4ffa4ed5ef1cf7cc9dd93fd593ca22a09067660b3ec8c9e6b4d9d47317d3168

General

Target

JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe
Size

187KB
MD5

5b3ec8fc824850800a87d11401c3685e
SHA1

1d7f9754535b6ec8ad6e6d63a2ec39652f1b7038
SHA256

d4ffa4ed5ef1cf7cc9dd93fd593ca22a09067660b3ec8c9e6b4d9d47317d3168
SHA512

c8e97eb196a203af3e2b4919a7cfa18bf2ae6a530b3b27e5b3d156347693d1a9434d452da8db8ae6e8a849096e5166c965e4e82d85d90281cd1d36423ecb1b76
SSDEEP

3072:4HgmCIXvUe+hYrjR5c9RvNuGAAaXhBGVc1SeaHttzrQOyIZM/E:4pxXShYrty/FucaSVcglHtNPyQM

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3572-9-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3920-14-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/3920-15-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/5024-73-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3920-180-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3920-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3572-7-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3572-9-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3920-14-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/3920-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/5024-73-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3920-180-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3572	3920	JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe	82
PID 3920 wrote to memory of 3572	3920	JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe	82
PID 3920 wrote to memory of 3572	3920	JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe	82
PID 3920 wrote to memory of 5024	3920	JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe	90
PID 3920 wrote to memory of 5024	3920	JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe	90
PID 3920 wrote to memory of 5024	3920	JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe startC:\Program Files (x86)\LP\D3A1\60B.exe%C:\Program Files (x86)\LP\D3A1
  2⤵
  PID:3572
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b3ec8fc824850800a87d11401c3685e.exe startC:\Users\Admin\AppData\Roaming\17673\52ED3.exe%C:\Users\Admin\AppData\Roaming\17673
  2⤵
  PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\17673\3A9B.767

Filesize
1KB

MD5
14eea6c7f69af5d45bc3e9fa6c817f6d

SHA1
8b28e29a47cdfad2eb38fc1e5835eacaec3ea541

SHA256
dc7023784a4ba59b06d326a082130b6b3229736583504af1309674980ab4d4d4

SHA512
11f2437da7b474b1175a2bfdc926889c2670886e185235a5ea803359d1c0f89ac49f40757f87ec155908c0f1c34e084fc7e65c81f7f9ffd5930b371bdbd56dc1

Download Submit
C:\Users\Admin\AppData\Roaming\17673\3A9B.767

Filesize
600B

MD5
a48e77125b2f1acc893866b687a738f3

SHA1
b57d1939a83d402fbf1c9982e9410fcf995796c2

SHA256
a65bc18423c69dedaf7392a02fc37e0686a6aa09e8a01b0aca22fe886ce28b96

SHA512
a6ab348ed707fa1dfab260719872325f5655474283470a1628ca974e85f447e9db7b0a92abfb209e42c13eb93513e355744f5230718cd58b74b6cb034ca659d8

Download Submit
C:\Users\Admin\AppData\Roaming\17673\3A9B.767

Filesize
996B

MD5
9d0368052c76d5c13e5c99f9bf0e46b7

SHA1
ab2924e08b45ce14298b8fb2ce5ce3d5f4b45f29

SHA256
4833ded579d62e7ecd36209db5513db04a20ee834b9fa8c802e2450858d673ca

SHA512
b7c7926703b2fbf2bd63a0ec1f90737b6be596432d6cddc11b1d4af0e4772bac6cedbb4c1c4ffc8db16fa4623761c8869daf51df6123ea3eef2ff04929cdde74

Download Submit
memory/3572-7-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3572-9-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3920-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3920-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3920-14-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3920-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3920-180-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5024-72-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5024-73-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing