cycbot | 17664145227c0fd867345333448b0f13228d2214c2e7299918aa133e28e1c5db

General

Target

9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe
Size

174KB
MD5

9311b14b478c3c60e04e806960c58f73
SHA1

3a19ecc1dce54ffd892f9ce900482f1df9198f14
SHA256

17664145227c0fd867345333448b0f13228d2214c2e7299918aa133e28e1c5db
SHA512

766740b601c2ac935ce354318672b50ec9669a7fa377df0030da3aebdd24e961d0ac7c0ab30bbbbed1bb14423d7a5bf6e821a462a7417cce301d6273532f1836
SSDEEP

3072:epzzsJBolVdQbqRiicVMRzuEWmRlp5hRCsRpX04bvbNjdP4a5ZDOWC:m/eBoHdQbqRpcVMNufmRl2cpX04vNjhu

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

Processes:

resource	yara_rule
behavioral1/memory/2500-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1976-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2992-86-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1976-87-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1976-157-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1976-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2500-12-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2500-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1976-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2992-86-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1976-87-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1976-157-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1976 wrote to memory of 2500	1976	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2500	1976	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2500	1976	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2500	1976	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2992	1976	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe	33
PID 1976 wrote to memory of 2992	1976	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe	33
PID 1976 wrote to memory of 2992	1976	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe	33
PID 1976 wrote to memory of 2992	1976	9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9311b14b478c3c60e04e806960c58f73_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A86A.79A

Filesize
1KB

MD5
17e3822813c512227bae8e314681e682

SHA1
1c05b08900864179efe6f7c85e8659adbc3ba5fb

SHA256
63fb23f4606302ac3cf37dd12dfbf5a630f6b5928b25d4919c016e856dd667a0

SHA512
2d22a5630d7b3953f16a02a47bfdeabcf255563daa9d3d6665681c8931fbb69065e41ec212258e177bf38fc2552b7dcab700eec93afb4f4371fb742d94a6a7f2

Download Submit
C:\Users\Admin\AppData\Roaming\A86A.79A

Filesize
600B

MD5
21cc7292107ee2604a2beacf0bf36fec

SHA1
4efe38cdc0c4032157b317a26d60ffec2210a5fa

SHA256
d36095484fa657fa30b8ced679141a4fc7d1bee02b6c73547d0db90ae8d46715

SHA512
e8b9dd9c3da2a2bd447269c893e7a572c9881f9c9fc949014244fce8974be8164da88f57e0bfa9423b6185bf697116e9896c470e3db3f51b21ec68f7ca19b238

Download Submit
C:\Users\Admin\AppData\Roaming\A86A.79A

Filesize
996B

MD5
df5b4123b0f2268345221d74fb5bc964

SHA1
09954c67ebc9f0d51f806583275456cc939d5013

SHA256
50a87cab5c8fa68e57fc0e63b3993fd39236185c363caddb94cf20a1eaeeed64

SHA512
96db3e0e91f63332c013e822e97e002fccb6bf0d235ced999bc6b509a23e67fc2414787b06d9ae6e90dfd74c1bd888d69775cdd5db20710667f16835d696b7f2

Download Submit
memory/1976-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1976-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1976-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1976-87-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1976-157-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2500-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2500-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2992-86-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads