cycbot | 67bb091e1283a4cd1b0f081545c613f022c0bcc131d7abc7e77a9fa8941e3469

General

Target

JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe
Size

174KB
MD5

6e5cf8963444efe366f705609c2952b9
SHA1

52600f4cf68c7d94a023786277fa299e01e48a9e
SHA256

67bb091e1283a4cd1b0f081545c613f022c0bcc131d7abc7e77a9fa8941e3469
SHA512

c965cb93fdc207fee5de03214bac403af9f9eb3a1771864c43fdaf9df1bdc1851ba79a884c7faf80bf11e9b3690399ca69973432c30736a86382add73191c9b6
SSDEEP

3072:FpXkBisIqa2hkrLR9R6dMlL2s2IS0ZrwGLQQjifZGqcM9YJaRydAGAFfkxvfl8Fa:Fp0v6B9R62EDISSrpLQEM9XRy2Gw8vt

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2716-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/2252-15-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/2252-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/1820-138-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/2252-289-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2252-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2716-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2716-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2252-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2252-16-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/1820-138-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2252-289-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2716	2252	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe	30
PID 2252 wrote to memory of 2716	2252	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe	30
PID 2252 wrote to memory of 2716	2252	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe	30
PID 2252 wrote to memory of 2716	2252	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe	30
PID 2252 wrote to memory of 1820	2252	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe	32
PID 2252 wrote to memory of 1820	2252	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe	32
PID 2252 wrote to memory of 1820	2252	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe	32
PID 2252 wrote to memory of 1820	2252	JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe startC:\Program Files (x86)\LP\1A35\95C.exe%C:\Program Files (x86)\LP\1A35
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e5cf8963444efe366f705609c2952b9.exe startC:\Users\Admin\AppData\Roaming\56EBC\7D81A.exe%C:\Users\Admin\AppData\Roaming\56EBC
  2⤵
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\56EBC\C0A4.6EB

Filesize
996B

MD5
4eb9e5110f416b2de0a900fe03e2de8c

SHA1
9679daa63d5884d46dcc21cd983e9f85adc4ad2e

SHA256
709346dd67f2f01f21aae9a8dcda2a5cfc8092cb980bdd802f60f462abefd07b

SHA512
88bc72464aaa3a36365c81b2ea6df75dbaf588e8020be3aa85dd9be18e06f82730bfdd6921d64cf3a8efa7fd20445bdddb844631650464114923fa6813f92068

Download Submit
C:\Users\Admin\AppData\Roaming\56EBC\C0A4.6EB

Filesize
600B

MD5
297d5306234ccb86fe8f757f5b7de6a7

SHA1
6230ded4689c166d14a48d9d97a5994120cd48b5

SHA256
63fe4362d44df3ee85ba6075d01f5602bbdfd4d83533ce626a36c93c7a3273e6

SHA512
238a48237e6146b02631ddf35a056131d61cbb1baa3ba1a801b79dfaf2dbb885670ee22df564b694e2a4b0bbe898da6b1b7f04b750a2448f2261ce7e6adbaf59

Download Submit
C:\Users\Admin\AppData\Roaming\56EBC\C0A4.6EB

Filesize
1KB

MD5
f247c9a2345350990480663b31d4a356

SHA1
234178347ee27276dc818ae7aa3ed71ff2a95e3f

SHA256
72e2e4f80f57f07cb4e62a1756fc20fd4b537cf8f015797c42c77259f179c046

SHA512
a94e2f92d8838e4e1e8b2893c4ca25ca2d6a46e4f606f7552c5e3a2b54631874af5ceb90ee0ea4dc8d36f03c180850d1faebd5abe743ae90ce8597b82a29e577

Download Submit
memory/1820-138-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2252-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2252-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2252-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2252-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2252-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2252-289-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2716-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2716-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing