cycbot | c0468f8de5fc52a985a37fc3cf0ffccf3b7e60c4055bcd2b3c716beb75178f6b

General

Target

JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe
Size

197KB
MD5

6d2c536976f7aaebca2551f244d2b418
SHA1

a75f90203c23619511ca83314c49e829381f3b64
SHA256

c0468f8de5fc52a985a37fc3cf0ffccf3b7e60c4055bcd2b3c716beb75178f6b
SHA512

342bc964e813d4b5076a910b5c4d3f46b1a505287c603e5993308d5e69cf68450ddaae24cf4e57e46ad83d4892cc48a77e3ae2855126f20e64faf8add25d5dee
SSDEEP

3072:IJh43aJK0KdhDzgHKEevptK3GibiqZP+KBOFXpoSbZpL4QIm436qSukrTNj:8e3zgqEi03GiOCDgdpjlpL4bb6Fpj

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2544-7-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2584-15-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/1572-83-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2584-185-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2584-2-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2544-5-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2544-7-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2584-15-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1572-82-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1572-83-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2584-185-0x0000000000400000-0x000000000046B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2544	2584	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe	30
PID 2584 wrote to memory of 2544	2584	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe	30
PID 2584 wrote to memory of 2544	2584	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe	30
PID 2584 wrote to memory of 2544	2584	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe	30
PID 2584 wrote to memory of 1572	2584	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe	33
PID 2584 wrote to memory of 1572	2584	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe	33
PID 2584 wrote to memory of 1572	2584	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe	33
PID 2584 wrote to memory of 1572	2584	JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d2c536976f7aaebca2551f244d2b418.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\40C6.3C1

Filesize
300B

MD5
55361df0b8fb3d26200faf496ab3fbad

SHA1
b8b0f1f406d32e657a194fef501059eca19b8dea

SHA256
8914729ee22f40a6ca3147ee7d8abbdfecd29dd3a180f036420768abeb06c0dd

SHA512
ea65318a8533fc68df4fe2e6348b90b0712ee9bf872d6422f933bdce29a1d2fe486edd1058412058c941bae2657ebcb41bc9599d900b483c69b08420d93f0435

Download Submit
C:\Users\Admin\AppData\Roaming\40C6.3C1

Filesize
1KB

MD5
328744cec502cfba735eea6038794301

SHA1
b375082a3ee943fdc02c89145e315d713720304f

SHA256
0482e08d52645379595d6bf0987623e89baed926721cd7c9a6a8eb9f6b9dd7f5

SHA512
00fbbc5becac440de512c46ca8e73a7b9fe87dcb625e90b18e96a20e758e8b32cec26569f4bb88be9d80ffa3802918b622813ce08a88544a2e87a8dec253f2d1

Download Submit
C:\Users\Admin\AppData\Roaming\40C6.3C1

Filesize
600B

MD5
e55b9e8bcd3730b747e354e438163e24

SHA1
6beb731a3b32682952caa40ed3d297b9dfce6fb0

SHA256
4c1876f9f9e591f1ef6835a233e7b1312371c494a9fc009005fd4b4820208e48

SHA512
0b80390c97e882d4815c4180221e5de9acedf43fd1775d5a8472997b3a1751b40164807771322b302094f0ead93480b4b6cb982e5e2f0a691080c485d2848303

Download Submit
C:\Users\Admin\AppData\Roaming\40C6.3C1

Filesize
996B

MD5
934c03d491463fb154b5775b7ca39368

SHA1
f2e49e10417793100cc61be8475993e33689bf63

SHA256
29b4e794ba1cfe79d84a6891143259ff3ddbea9867ff76a368a1b468000a24d5

SHA512
3d6d89e19ceb4aa9189b030bd5531e995e745c82dee4f010c5a7700ad33b7d5d9f4e607127387de08bdae9953d885210deb36f89fb9626e6b950db6a8b23a05b

Download Submit
memory/1572-82-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1572-83-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2544-5-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2544-7-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2584-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2584-2-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2584-15-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2584-185-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing