cycbot | 7e2f51519b393215f2e573e1e2fa9dadf37967a2193b2490012dbdc37bf5f52e

General

Target

9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
Size

169KB
MD5

9353e6c6dc1502faf3666f695e703198
SHA1

edb3f50c1a8039a5c2424b42cdf1dc5197c18e32
SHA256

7e2f51519b393215f2e573e1e2fa9dadf37967a2193b2490012dbdc37bf5f52e
SHA512

895aee099139ddc5c9133129ba3e067839062ca5537508038e923b6aa54fd534b92ae6c1eea7a14724a7ae99dc03d5b484e919c127d096d0349e337e72aee539
SSDEEP

3072:CvV4TXwc73E+0Y8gal6HFbZPVbu9gU3HCc6gmT2NQQa+uSX+vG3kWP:CvyTXwcLEXYoyNm3ia1U87P

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

Processes:

resource	yara_rule
behavioral2/memory/4504-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1668-15-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/1668-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1668-81-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1300-84-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1668-179-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1668-181-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\91406\\AEBE9.exe"	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1668-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4504-12-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4504-13-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4504-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1668-15-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/1668-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1668-81-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1300-84-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1668-179-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1668-181-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe

description	pid	process	target process
PID 1668 wrote to memory of 4504	1668	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
PID 1668 wrote to memory of 4504	1668	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
PID 1668 wrote to memory of 4504	1668	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
PID 1668 wrote to memory of 1300	1668	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
PID 1668 wrote to memory of 1300	1668	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
PID 1668 wrote to memory of 1300	1668	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe	9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe startC:\Program Files (x86)\LP\E939\873.exe%C:\Program Files (x86)\LP\E939
  2⤵
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9353e6c6dc1502faf3666f695e703198_JaffaCakes118.exe startC:\Program Files (x86)\0673F\lvvm.exe%C:\Program Files (x86)\0673F
  2⤵
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\91406\673F.140

Filesize
1KB

MD5
16d3fe3ad004cb2fe11d19eb84acc3fc

SHA1
b33bd0307992a3931e4e247b19219aa59e4614ac

SHA256
ba55ec4d758af41157b11544c1d787663ebd7cdfac6c8bf7dd703dd6b9e2fc64

SHA512
45a1054455ad0ac8bc8694e360b39b3d7758f08ee8bb5ea8d4481f5c61954148b64100b9baeb5b38708eeb330f45a1301e2249c57e25fc4f8bbabf717231fb71

Download Submit
C:\Users\Admin\AppData\Roaming\91406\673F.140

Filesize
600B

MD5
e916b5be81b245f40acf0b523ff5dae4

SHA1
df4da50b04d0ed037e0cd9d8dad9757eb55fa88f

SHA256
8fe798a404bac8d77f2274b01f8aa24f22df95808b3c9f092e8e56e1cfe0d073

SHA512
49ee313d21cf7c57bc9ce6e9bc520322b65958b98d2f27110f1b36d179c903661ba4cca4d14d508a4663d599416be1c960a71fa94b2c6bf9d2083a08719c3ee8

Download Submit
C:\Users\Admin\AppData\Roaming\91406\673F.140

Filesize
996B

MD5
ac8a1dfb3c29e8976549f20c6a4d66c5

SHA1
83408fd5792b74541b760e14a39113c60d4b9958

SHA256
25333138a7dffd2b7a463b0b3d49216972d3bcb3c5cd359888a00434f0baa4ea

SHA512
ef6150a908e72ab064f32a0da846420697855e59d5266de640ea738f051f5d4f4c627b4f40c2682d72a0860aa08ac7e4cf71d2658a7fb69904989e08e8077045

Download Submit
memory/1300-84-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1300-83-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1668-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1668-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1668-15-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1668-81-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1668-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1668-179-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1668-181-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4504-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4504-13-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4504-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads