cycbot | c0eff96d090b32f6b6f0ca7ade85b60cea071d75e02348a08ccba8cae8f73d5e

Analysis

max time kernel
140s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe
Size

205KB
MD5

938060f647b1fcd24a7a807228c9f92f
SHA1

d9f4d0b347f80b24922bae1777cb79e7276f5d5e
SHA256

c0eff96d090b32f6b6f0ca7ade85b60cea071d75e02348a08ccba8cae8f73d5e
SHA512

6e1f97585243e7b4abba67b07a6c5e1d5edc8be57b4adcec868e7637b88af971202ffd2fcc3d9e8b1f4e12350f31fb33bf04b7405f047c3f27b29b814334d8e3
SSDEEP

6144:8aE9xeFTXduDJAie3Ltz1Ljqw9ViCGfWT9Bpm:1Eusa3LtxfqwFg

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/5108-11-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/5932-12-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/2112-87-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/5932-191-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5932-1-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/5108-11-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/5932-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2112-85-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2112-87-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/5932-191-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 5108	5932	JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe	86
PID 5932 wrote to memory of 5108	5932	JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe	86
PID 5932 wrote to memory of 5108	5932	JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe	86
PID 5932 wrote to memory of 2112	5932	JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe	98
PID 5932 wrote to memory of 2112	5932	JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe	98
PID 5932 wrote to memory of 2112	5932	JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe	98

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:5108
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_938060f647b1fcd24a7a807228c9f92f.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\50C3.8DB

Filesize
600B

MD5
6901198f7e3b01c7fefa5879cbb8b395

SHA1
2681dc15c7d9590e602b7c3d25cd0741a12b9974

SHA256
f5cfddedc86392c1d4f379eef6e6b43346d89e60f9306819c1a0994c7bfdc040

SHA512
a9369200d13ab97f93f30772bd7c11cffe5b869d28d9c5e3e20ee9af2febbe6c65d3f346683b817276862a537b84f297f39d05c3a7f589cd6ffdaf955d64035a

Download Submit
C:\Users\Admin\AppData\Roaming\50C3.8DB

Filesize
1KB

MD5
1ab5b040b2e1f61c0db578023eaa4d73

SHA1
6b2b68bcdd77dbe47660db4549fa29a66ac31abe

SHA256
f3a1e657a6bf11c359a7e225180af2052756ef79a9bef6c836f390f626d37c2e

SHA512
ec0d2ec429a735b4d822db7acd73ad8425d4c9bbccca65448bd1fdcc3a74e8fa4cfbe45a04964c1f1e38eb6855992f8e2d35c57edea4a665e7ec58ee2cb6d446

Download Submit
C:\Users\Admin\AppData\Roaming\50C3.8DB

Filesize
996B

MD5
7dab4e27927f1134780974e3d221566a

SHA1
6d5f964bb830123089f1fea10ebc1fc5ee3db76f

SHA256
16969f82d61549e3d3d4ba1763f91df645378b749e93b2e9ebd6929a22996c9e

SHA512
d66b7be244954a0cd800fce77282d29dc65fd8575f2559c2f94e85d790573b9a6310e1a9f592822fc12dd939018048ca5beebe7f7d2cb556b037766f43f5546f

Download Submit
memory/2112-85-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2112-84-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2112-87-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5108-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5932-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5932-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5932-191-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download