cycbot | 113414ba40e0cf76e2b5ab71419e30fda53d1bea7bb918962fc8c12a84746a1b

General

Target

JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe
Size

199KB
MD5

5e67cf5099e201c63b5b5d32cdebce33
SHA1

2bdcd25e8988254148e5dcf5949f43546559d81a
SHA256

113414ba40e0cf76e2b5ab71419e30fda53d1bea7bb918962fc8c12a84746a1b
SHA512

d1e77814726fef1928742b41ff6f7a60cbf304c6cb8cda8ec336cf32a622fab97e8fd804eb2940252cf3eb53403bf3c56b1e5d82f3f2d2a8c73328cc4c15e140
SSDEEP

6144:SBd6Qler5cPh7y39r4RG1ifLgeJrukaQb8H:m8QlpKriG1ifLg+Fg

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2428-6-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/1968-13-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/2484-73-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/1968-177-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/1968-214-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1968-2-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2428-5-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2428-6-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/1968-13-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2484-73-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/1968-177-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/1968-214-0x0000000000400000-0x000000000044D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2428	1968	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe	30
PID 1968 wrote to memory of 2428	1968	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe	30
PID 1968 wrote to memory of 2428	1968	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe	30
PID 1968 wrote to memory of 2428	1968	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe	30
PID 1968 wrote to memory of 2484	1968	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe	32
PID 1968 wrote to memory of 2484	1968	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe	32
PID 1968 wrote to memory of 2484	1968	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe	32
PID 1968 wrote to memory of 2484	1968	JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2428
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5e67cf5099e201c63b5b5d32cdebce33.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BAFD.463

Filesize
1KB

MD5
80ee89a3f0544192182b115519071dd1

SHA1
e8cc016016e2335bfb03fd362688381bbf27f489

SHA256
c4c8d64012a15c67d5661bf1b1d3d470f88a45d6a3606b0d4df62ce3d7c72c60

SHA512
2f51147496d61e155837f11f588b69add7739d82828d05be4d26044e8c829cc72a24c4b733c13de2df1e5c941944cfcef69945113d54a7a6dad5e8f51183ba10

Download Submit
C:\Users\Admin\AppData\Roaming\BAFD.463

Filesize
600B

MD5
98fd98b708b2443e37569b076cf91cfd

SHA1
0c4698e4b7dfd2509121f8c97f19e434125556f8

SHA256
115c017e7caa343afe48ab9f2bf6f305136213524ea2bd4e9c7eb8592555bb99

SHA512
e1d0946f2d9b97fac6aecd253e178a8ec0709a56b903aa1bf274569f385979989c48f4d355c81f35cc12206b97d33471b20970022b44d60b2aec4efc0c170971

Download Submit
C:\Users\Admin\AppData\Roaming\BAFD.463

Filesize
996B

MD5
1d580d0d8dfabf631d2792b2faf425f9

SHA1
e9687da932773cb776686f5fb75fbecc3f2ba117

SHA256
9100aba062e23fb5d0cba82ff9ce1d867f082f191a8677290e3830a0ee08e111

SHA512
7d1b5e2634528e54fffc462c6a06a80d0af4137420d4f4060162ce326453048e261dc832970ee8859b27dbc19566d2daf72431fac6f43cf25e35c367bca004c9

Download Submit
memory/1968-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1968-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1968-13-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1968-177-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1968-214-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2428-5-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2428-6-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2484-73-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing