cycbot | 31fe5610b77ae98968b1abe73e6cf6aaa201a431c5f1f7a9cfbca74c284306ae

General

Target

JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe
Size

180KB
MD5

6194d426e72ce347073a9d734ee35429
SHA1

3d7520b2387352a480fae6273d667c8f9d137dde
SHA256

31fe5610b77ae98968b1abe73e6cf6aaa201a431c5f1f7a9cfbca74c284306ae
SHA512

8e4bdad0625801ea0d5087e501466627a9b9df1a6bdce77c8c84ec39643ed327c2e477bb125aabc4f5cd1dd39a5bce9b46396e8e08ac4dbd58f4589c154bfd68
SSDEEP

3072:try0hazeri4zgH3Bffy/cF6ZEKIdN6+uGyEn2tz/NBXOPen1F+P6JQ2F4vKG5Md:tr/rhzOfh6ZgfuG1ezNBePN1k4vLQ

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2252-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/4968-15-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/4968-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/3964-130-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/4968-289-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4968-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2252-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2252-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4968-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4968-16-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/3964-130-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4968-289-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2252	4968	JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe	85
PID 4968 wrote to memory of 2252	4968	JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe	85
PID 4968 wrote to memory of 2252	4968	JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe	85
PID 4968 wrote to memory of 3964	4968	JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe	86
PID 4968 wrote to memory of 3964	4968	JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe	86
PID 4968 wrote to memory of 3964	4968	JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe startC:\Program Files (x86)\LP\34A8\3ED.exe%C:\Program Files (x86)\LP\34A8
  2⤵
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6194d426e72ce347073a9d734ee35429.exe startC:\Users\Admin\AppData\Roaming\8B2B0\94934.exe%C:\Users\Admin\AppData\Roaming\8B2B0
  2⤵
  PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8B2B0\05C7.B2B

Filesize
996B

MD5
a3577c4c83efae888bf45853a3f5ef00

SHA1
d5281f58580726f26504cd0917bd90ca1f63775c

SHA256
c4a8042d7e39a93ae1b9250f4ce95b23403324000f20e68e8c18197fafe52e3c

SHA512
438e43e3dbdeafe1ec62b534330a57b61bcc67a4f8b1b73a49e4d96c82b7c60445f0b8db2277e54f6572c963664e9b0db57b01f82636e33ac1f7bd9015ceeaaa

Download Submit
C:\Users\Admin\AppData\Roaming\8B2B0\05C7.B2B

Filesize
600B

MD5
34e2fb44307f9bb0916a37f940174f2a

SHA1
57db75947326a3339307640bfbe0637399d3aa9f

SHA256
82527e04c05ea8a69f78a5af51210f54ee6ac64eb46d6c83270a92743ce61ed1

SHA512
239e8663c1781e4431c2cc64dfe80f03fff64c074c5ebeb8f21ec8119a37073f3b9561bd7e3d84857ae504e6373c9757624148db9a0249eb3c9e0b44098ccf51

Download Submit
C:\Users\Admin\AppData\Roaming\8B2B0\05C7.B2B

Filesize
1KB

MD5
7d6af364c1c6fae5de136c9f4a24ae3d

SHA1
9509fb6b1347ad67b443936a2019cb8d28bb35dd

SHA256
2f9a51a595b63309c70604476dc924b01525c0d127da7ac9af279015c6e47c01

SHA512
a37ce1c5e76a861b26bb329638ad08f2a35c5ed83624f40b23148a98d3286c90b7be9928e99cb92ef18b36a18d76bcdc65e98dc8e9c5f5ab721765eeb5965a1f

Download Submit
memory/2252-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2252-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3964-130-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4968-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4968-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4968-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4968-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4968-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4968-289-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing