cycbot | 0f04d91dd99971caa405a50fd8b3f851274fb3a53e9f7b1a9421d5114c812f5c

General

Target

JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe
Size

192KB
MD5

66fd0fb4274d33d3d5b8ab0de8a7d26e
SHA1

165203d458ff5aa7d764cc2bd4ff4799b2103aef
SHA256

0f04d91dd99971caa405a50fd8b3f851274fb3a53e9f7b1a9421d5114c812f5c
SHA512

5b255ef6abb1cfa2a861195035e822c7fecd24c2c9f48684acb9c5fd684e85dca5ae99a4b445d17502b8f534f4b2a461becd858a89f80892cc7574255a1c8203
SSDEEP

3072:YfjOTKIudVwHQKde3sojb0t2AP89BENUH+3PkC66UuwzCt4ld/GBNkPWmnBnU:Y7YKLK08mfg8CUoPUBCt4l0kPPU

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2380-7-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/1068-14-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2792-77-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/1068-161-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/1068-198-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1068-2-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2380-5-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2380-7-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1068-14-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2792-77-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1068-161-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1068-198-0x0000000000400000-0x0000000000447000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2380	1068	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe	30
PID 1068 wrote to memory of 2380	1068	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe	30
PID 1068 wrote to memory of 2380	1068	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe	30
PID 1068 wrote to memory of 2380	1068	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe	30
PID 1068 wrote to memory of 2792	1068	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe	32
PID 1068 wrote to memory of 2792	1068	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe	32
PID 1068 wrote to memory of 2792	1068	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe	32
PID 1068 wrote to memory of 2792	1068	JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66fd0fb4274d33d3d5b8ab0de8a7d26e.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1BF1.271

Filesize
1KB

MD5
5b134a9b9986767e8bf3a1e546ed13de

SHA1
198a2f7cfa03fb32f4e405082a7483039194e268

SHA256
7576bccab3968effc02fb679b9dc2525d1b79f109c2c5a6b2d4adec9db512b3a

SHA512
9d478139e0dd91876c5711ea6035d45f60bb853c635209834829ae30b9740ff60209a591ea969f04d3df2d08df13fa89eb1ce0f100b6195308eef846261947ec

Download Submit
C:\Users\Admin\AppData\Roaming\1BF1.271

Filesize
600B

MD5
9f662562eb78c02e6d742dd7feab1b32

SHA1
64381ab77b9f41137104aa32ddc75d62b222f869

SHA256
75e4f2abbac1736f9d0219b85a8271563d14adf25097b8db2f3abc58f8f40922

SHA512
431741acd48629050ec7064909ec134216fdb550865511667697a6379f0f6aa0d56df73c73b10ebd296c3954b14b3e34bbf2835a23aba910a91f10ad96e8a0ce

Download Submit
C:\Users\Admin\AppData\Roaming\1BF1.271

Filesize
996B

MD5
afdaf1a6a689ceb8ea8ed0b948006649

SHA1
cb7cc6d85b3b537fd26d212431d35c6784936380

SHA256
879a6f11f59cf7eee67a41f881d84ce7be784802dbd4b3e7f0bda1cd61e7967e

SHA512
4d092909c3155d4f27f9dd21c724f942183a1aa3ad5cedd2b789bc5eb12239964056dcd164278013de94f929b3a75abea78257c165c158b0c0f8400c73131818

Download Submit
memory/1068-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1068-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1068-14-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1068-161-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1068-198-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2380-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2380-7-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2792-77-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing