cycbot | a3c09d3cf96db63781276de01c8207009fcbaa29ebe0f42f87ef682ef9372c3c

General

Target

JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe
Size

215KB
MD5

97e560037699958c8ec8fee9f3fa4a58
SHA1

82086393fc032e7b5face9369fce53af8905260e
SHA256

a3c09d3cf96db63781276de01c8207009fcbaa29ebe0f42f87ef682ef9372c3c
SHA512

a9e690fc11d5a15c1cdae2089f102d1e07798f045f6b75ee79c6be5ddc54be487fffa12297b5d5ca0dcc9725422d9d6a8731dcd8c86f5620454fab07109b4874
SSDEEP

3072:YWHOnNr/9t67gZidU5YMlO64d5bXvhnczhD32ydXdRmCMDQzMkG9hKhUASRq7lIS:F0NrXSaWML4dd61DtPmCMAUA443EDfk

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2252-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_cycbot
behavioral1/memory/2604-15-0x0000000000400000-0x000000000044C000-memory.dmp	family_cycbot
behavioral1/memory/1344-80-0x0000000000400000-0x000000000044C000-memory.dmp	family_cycbot
behavioral1/memory/2604-174-0x0000000000400000-0x000000000044C000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2604-2-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2252-6-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2252-7-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2604-15-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/1344-78-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/1344-80-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2604-174-0x0000000000400000-0x000000000044C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2252	2604	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe	30
PID 2604 wrote to memory of 2252	2604	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe	30
PID 2604 wrote to memory of 2252	2604	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe	30
PID 2604 wrote to memory of 2252	2604	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe	30
PID 2604 wrote to memory of 1344	2604	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe	32
PID 2604 wrote to memory of 1344	2604	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe	32
PID 2604 wrote to memory of 1344	2604	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe	32
PID 2604 wrote to memory of 1344	2604	JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97e560037699958c8ec8fee9f3fa4a58.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\016B.6EC

Filesize
1KB

MD5
2337eb5471b122aecb9c883db2e43ef4

SHA1
2eba2f6c486cd85b06c8331f6f4de64786309509

SHA256
77c1fb85654e75a807025be74d78936162544c9d28c72e8692bf1f0dc8626ba3

SHA512
e558bbcd12d3a948dff9ba9effdce022ea21b20d5a25ab551c70e5c74108000689a88e1eb947764d377cd0156454ee30b7b604fb2410fb7b2f3a0b5971a5925f

Download Submit
C:\Users\Admin\AppData\Roaming\016B.6EC

Filesize
600B

MD5
aae41753a090ef15f38c05939b3ae8f1

SHA1
cfa7620f226d0e5874e28e9b27f764e33b42863b

SHA256
3dc8188cd3748e10a49f1f0d0183efbc91dfdee35851ca49948dc803bb24043a

SHA512
019109b661fb08c75171364036029f9da03ef0c4df216fc3a306024569e258be41e5a1c9f586631879d9e9a5a1546d8b7df4bf662e642ecae85eb3c9e8fa9701

Download Submit
C:\Users\Admin\AppData\Roaming\016B.6EC

Filesize
996B

MD5
5745f020b3376c4b3fae5522dc71183d

SHA1
17a48ab17301d3566b3bd4e3d2f85910e5db8390

SHA256
33866b8c3a7c14cf74906cd5f17f29323453c3985339e0145ff3a2c4c6f2c926

SHA512
f689c9e31e6a85ba3c220cdcd3dfb6f8d91aa9e52ce8b09a0d3ad269f6969485d625b4eda41075e1f9de1038be72a4f7a5dd7a4ec09a3bf16cce5a5361ef8234

Download Submit
memory/1344-78-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1344-80-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2252-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2252-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2252-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2604-1-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2604-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2604-15-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2604-174-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing