cycbot | 0c749afe336ecfb6ddb8dcbd620df63704990a94ff180c3ccbc7e716928d671e

General

Target

JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe
Size

186KB
MD5

6549a09958069c1a36b7c000d514ca73
SHA1

a157a1167862897bbc194872cb670df94ab6af45
SHA256

0c749afe336ecfb6ddb8dcbd620df63704990a94ff180c3ccbc7e716928d671e
SHA512

f334dcfafc68e46277c023a44574c929788d90161b562a22237c0d5fa5f2d13a5b81ceb20e8c145c6c140287a4cac1ae0145ad492b23a98e70f601cc5ff9aa83
SSDEEP

3072:oOyI46ObiwWsuiy0qI7TNBw8UaGKFra3f0jrF0c8CxPwwv8XhlB51O0:sB6suiy0rNBihbcNxPwwv+7

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1760-9-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/1752-10-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/1752-11-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/3064-80-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/1752-187-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1752-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1760-8-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1760-9-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1752-10-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1752-11-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/3064-78-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/3064-80-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1752-187-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1760	1752	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe	30
PID 1752 wrote to memory of 1760	1752	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe	30
PID 1752 wrote to memory of 1760	1752	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe	30
PID 1752 wrote to memory of 1760	1752	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe	30
PID 1752 wrote to memory of 3064	1752	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe	32
PID 1752 wrote to memory of 3064	1752	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe	32
PID 1752 wrote to memory of 3064	1752	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe	32
PID 1752 wrote to memory of 3064	1752	JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe startC:\Program Files (x86)\LP\9A6A\EB5.exe%C:\Program Files (x86)\LP\9A6A
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6549a09958069c1a36b7c000d514ca73.exe startC:\Users\Admin\AppData\Roaming\A3FC2\37C9A.exe%C:\Users\Admin\AppData\Roaming\A3FC2
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A3FC2\2D5F.3FC

Filesize
300B

MD5
7ffba573ab12fcee9373ca6594a806e0

SHA1
de2514288d23732a4805f33462f1e145f00ecbec

SHA256
77d443ccd9a4bf7a695602f92fbfc16fa54f6a184435f67e53b55afc4a408081

SHA512
7cb337a15a64377986c33d43b6a0aecd03efff9b4de82d1b65bca0a658b16b96a26974fcb9398e182fa03f589f01920dc39ceee80c75b3858b044917476ef4e5

Download Submit
C:\Users\Admin\AppData\Roaming\A3FC2\2D5F.3FC

Filesize
1KB

MD5
3c6c70026b698502b81acd846416e93d

SHA1
cb9698642dbc8d715ffba0fd9bbfd8dee4d1ce95

SHA256
edb3af7a4693f2ad61005b80879004edfe7f5295c955b681bdefd672a99761d6

SHA512
a9f219aedcbbb3c5c904469407cc81daff8cc1dcd0ce41d95c87cec10a2fae26ef50a996a2f49c475e0c84a073964db44f3b5086bddcf1ac5f24007d50753985

Download Submit
C:\Users\Admin\AppData\Roaming\A3FC2\2D5F.3FC

Filesize
696B

MD5
a6c9296cd10fdab80f672757de34be48

SHA1
b57e95b3f45bec09bb925b5d3bf2673fb3ff137d

SHA256
612707ad88533cbc1ebaaad4f34378a78c806f8991e6e1a1f9096abf73346a05

SHA512
a0ac38cabf8c5e9ece50ad140bb2d52fcc517d2d0ef37c42c9e2d9f81093de6ffec9086080962c76accf0b17d183e542de54a9ffc9b4fbac18922b249cecbaa4

Download Submit
memory/1752-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1752-187-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1752-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1752-10-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1752-11-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1760-7-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1760-9-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1760-8-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3064-80-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3064-78-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing