cycbot | a4b7f34d146d1aafe9275c39e73b55131dbd3d1cb2025b612aff85b13a1a8e64

General

Target

JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe
Size

179KB
MD5

70a7d9617402b6f535a6968c52cad98a
SHA1

3d345b22752a8ee71a5cc30c032852da6f99a087
SHA256

a4b7f34d146d1aafe9275c39e73b55131dbd3d1cb2025b612aff85b13a1a8e64
SHA512

fc09064f2c8d5e0a7b42ce1fe14deca799df66ef4b57f16545711922a82ef8fc6f87fb59098bc6e5bc7d17a4d2c1ce7462085b3f3ddbd815082cd349b881c054
SSDEEP

3072:JPKGw2PCiOWtD3qTsBih0pCKDuGCI3Byl/hsT4l5iilPI:QGw2PCiOWdlBih0p015iw

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1052-14-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2180-15-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2180-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/1228-122-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2180-297-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-3-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1052-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1052-13-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2180-15-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2180-16-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/1228-122-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2180-297-0x0000000000400000-0x0000000000454000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1052	2180	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe	30
PID 2180 wrote to memory of 1052	2180	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe	30
PID 2180 wrote to memory of 1052	2180	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe	30
PID 2180 wrote to memory of 1052	2180	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe	30
PID 2180 wrote to memory of 1228	2180	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe	32
PID 2180 wrote to memory of 1228	2180	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe	32
PID 2180 wrote to memory of 1228	2180	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe	32
PID 2180 wrote to memory of 1228	2180	JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe startC:\Program Files (x86)\LP\658D\AD4.exe%C:\Program Files (x86)\LP\658D
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70a7d9617402b6f535a6968c52cad98a.exe startC:\Users\Admin\AppData\Roaming\D5FAA\27265.exe%C:\Users\Admin\AppData\Roaming\D5FAA
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D5FAA\A2C6.5FA

Filesize
996B

MD5
bd34805e322b782210a84e194b659092

SHA1
55431531123d934946643cc02ff156e5504a57f5

SHA256
f99f6cf7d89c45feca8a0b4d874f1f0702c7cbe3e52471c8daee42df76a63047

SHA512
b24fadf98cb84709cd7004e5fea08817fa92dd0aff437eea2bfb367cedc57dea2a756abdd3a75065c9b7d1808ee72c4cc665be302addc885456745621e7d0d54

Download Submit
C:\Users\Admin\AppData\Roaming\D5FAA\A2C6.5FA

Filesize
600B

MD5
823822189f70da4e377d70d8ecd6e394

SHA1
6ce41fce3b57f139742d96a331665039e5fe4344

SHA256
4d2bd1367dbe5f574a6034b74d70b06a4b58f3d1e13146d1183110def9c58744

SHA512
fba2ad7bb29e4c5044e38b5a8fb2feb526f5718bd939f549e5e080991aab82b2a72fef69efd28ff51ad2b17328d453d5e0386a1322430d16e051f218b4efa3d0

Download Submit
C:\Users\Admin\AppData\Roaming\D5FAA\A2C6.5FA

Filesize
1KB

MD5
b66c87d0488f761cb31253ee410c1cc7

SHA1
8dc2632acaef1a91437bfc37b63c5cecb39c229d

SHA256
473f67e9b9ff8a03618882a47e4740ee2ca8911a9fd27fd10963e74dc1648e45

SHA512
b298269ca667836d1720150e762c1683a71b80f921bbc9a6d5a545c83ccaff75616dee4b75253b5c7ea7a6309d1687eb10a8d6a580b618472f9f5e602934675c

Download Submit
memory/1052-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1052-13-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1228-122-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2180-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2180-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2180-3-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2180-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2180-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2180-297-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing