cycbot | b9be127a6263b08a40bb2864e299d0e2dd8c0846280edb8c8b7c24056445de52

General

Target

JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe
Size

176KB
MD5

6b4084266635769a8c67f303cd527f38
SHA1

3f4d01312e7ea45fa3191a381a35384bde7880cb
SHA256

b9be127a6263b08a40bb2864e299d0e2dd8c0846280edb8c8b7c24056445de52
SHA512

5e7cdcfff1933e40138a93f7a2a602f70f143629c15845a12484ea2fc18e246d686517eb41e7f0c9fcfe07d92adde97b17170fd7e84575c08abc1cacfc009575
SSDEEP

3072:5csd4/PGUWbXPWhMryZmoGLkQ1fEA3affH7QQbqauvwZllL1W8zjy8wUk:WxOjXcyvoGNffYQQbqXclwkjDwUk

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2112-12-0x0000000000400000-0x000000000046F000-memory.dmp	family_cycbot
behavioral1/memory/684-13-0x0000000000400000-0x000000000046F000-memory.dmp	family_cycbot
behavioral1/memory/2800-79-0x0000000000400000-0x000000000046F000-memory.dmp	family_cycbot
behavioral1/memory/684-178-0x0000000000400000-0x000000000046F000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/684-2-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral1/memory/2112-11-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral1/memory/2112-12-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral1/memory/684-13-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral1/memory/2800-79-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral1/memory/2800-78-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral1/memory/684-178-0x0000000000400000-0x000000000046F000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 2112	684	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe	30
PID 684 wrote to memory of 2112	684	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe	30
PID 684 wrote to memory of 2112	684	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe	30
PID 684 wrote to memory of 2112	684	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe	30
PID 684 wrote to memory of 2800	684	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe	33
PID 684 wrote to memory of 2800	684	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe	33
PID 684 wrote to memory of 2800	684	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe	33
PID 684 wrote to memory of 2800	684	JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe startC:\Program Files (x86)\Internet Explorer\D3A4\25C.exe%C:\Program Files (x86)\Internet Explorer\D3A4
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b4084266635769a8c67f303cd527f38.exe startC:\Users\Admin\AppData\Roaming\4E303\0BED3.exe%C:\Users\Admin\AppData\Roaming\4E303
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4E303\3EE8.E30

Filesize
600B

MD5
8e3190f0bd93b2ac3d498e972b156d5d

SHA1
f6ddecab760fe5bac0d2231eda7341ffcf25ff58

SHA256
8af09f75c9ea8fab7820dccaeb15e7f7b3b8255669bc6746808252ff14a5e317

SHA512
f84b6357ef64bbb56d2b1982e71e162aac03f9e090af9a4bc57dbfe4611ad40ab4f47cb27ff88d34c3318a4b0e9e4a51f51ff6420c0f4f608296e69d416aeded

Download Submit
C:\Users\Admin\AppData\Roaming\4E303\3EE8.E30

Filesize
1KB

MD5
326f50ef68aa3ae51e69c4eb777993f8

SHA1
1f11493f63c502c09203d2301072098633684a5d

SHA256
e9ece4ef64994d60be2a0d29851107f36ea3f41584548dac14c991556df0204d

SHA512
0e56c6c92a5df7551d9f3e680b471f52b95e37eba0cda68d42ce245fba02856980926e51ab0aa778f28c30381965e34a51a001e1418077baad0e3c33cf3a5210

Download Submit
C:\Users\Admin\AppData\Roaming\4E303\3EE8.E30

Filesize
996B

MD5
cac12fe08a87430847467ccac1fb16bc

SHA1
f3f1ed2b0a47630171c2b8f3029a9622a6f261b7

SHA256
ea6cc883cd586f8a65a056e2b056ca7f6be5fa1772b0a3b51dfbe5627eb2ad79

SHA512
a607a1642c47106f6282c70a61335d5444a752f2143901ebb01d1b925e3f189134f87e4259a68b4eb935e071e833049e3f865b58cf456075ca300959b37b0ece

Download Submit
memory/684-1-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/684-2-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/684-13-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/684-178-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2112-11-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2112-12-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2800-76-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2800-79-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2800-78-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download

Analysis

Sharing