cycbot | bc64ee6197fcd3fadbb2e8fb0577a74f529c8b74b104e2b96e0c30af87bf66e4

General

Target

JaffaCakes118_95b66567078d995df8933d6da80f8922.exe
Size

180KB
MD5

95b66567078d995df8933d6da80f8922
SHA1

7a72d5f968c98cbf3e8fe757531a95441bd02482
SHA256

bc64ee6197fcd3fadbb2e8fb0577a74f529c8b74b104e2b96e0c30af87bf66e4
SHA512

53ea4d49caef21843e3ec6a92266820e2f3a76f733866da05c698871d684f8f5e1c217c7f8d63318512d7b51b76593671046e2c0cc16a2379c599d1d538ed991
SSDEEP

3072:T7ZfScoulv/rJhyJ7g+E2kvZkvuBt3y4ACA3kQmORgOykCC:T7ZfScZv/GRZXA3bG3k8sk

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2452-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/1292-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2688-72-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/1292-117-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1292-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2452-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2452-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1292-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2688-70-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2688-72-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1292-117-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2452	1292	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe	30
PID 1292 wrote to memory of 2452	1292	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe	30
PID 1292 wrote to memory of 2452	1292	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe	30
PID 1292 wrote to memory of 2452	1292	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe	30
PID 1292 wrote to memory of 2688	1292	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe	32
PID 1292 wrote to memory of 2688	1292	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe	32
PID 1292 wrote to memory of 2688	1292	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe	32
PID 1292 wrote to memory of 2688	1292	JaffaCakes118_95b66567078d995df8933d6da80f8922.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95b66567078d995df8933d6da80f8922.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95b66567078d995df8933d6da80f8922.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95b66567078d995df8933d6da80f8922.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95b66567078d995df8933d6da80f8922.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95b66567078d995df8933d6da80f8922.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95b66567078d995df8933d6da80f8922.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\102F.4C0

Filesize
600B

MD5
eb6516341ef1d5521818a2615327309b

SHA1
2ed6015c7acd688ee2e076bdfbd69b21bb422d06

SHA256
82735d842c542860f3cacc845efc4e3acf44ff2cf7a9c2d76a61b6a9c3cf943c

SHA512
cf286d97a187336435a4ba01d4175d7ea3ef764a4a8b1ddf5653b995059bebb84d254dc47669061a68c45d8e60d4c6cc6fb72a7e212621d64e288ac9396d5719

Download Submit
C:\Users\Admin\AppData\Roaming\102F.4C0

Filesize
996B

MD5
5dd5044a47f2b9dd8d67cd3ef1be7d0d

SHA1
1451d2794d7704587b56a766339f31aba13a6bb4

SHA256
94af50ea1ef1d2e93406f2f70417a732938dff7a836aa04e43d059b2571dda69

SHA512
2027e2450b6011dcddff340d4c274107be32fe7c20b9299582b34ceaebdd33502a9c6a8d6c0d1e745d7f152659462ab5ae6d8ba995372a1a55c505f39d438940

Download Submit
C:\Users\Admin\AppData\Roaming\102F.4C0

Filesize
1KB

MD5
3b2fe028664fe72d061d4c0d3e38c6c5

SHA1
601beccdf3b546f67521b70dacb414f23aca51ab

SHA256
32a078146a4de3149b234a7af8a9c97e78221df68ee1e85b94a97b87b098b8fc

SHA512
5eb233eda774e145e9afd65c372459c1f2a9ede908a8143a9f24a515c2034b79b38f1f99fcc106ee2c0bcd009453cc7fd68831e01698c5039a0fd8290415dda4

Download Submit
memory/1292-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1292-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1292-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1292-117-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2452-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2452-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2688-70-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2688-72-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing