cycbot | e0010881f8738b3b02286822f1c697d7ad2b0c3db4c5cb842f2bca004355d217

General

Target

940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe
Size

165KB
MD5

940d967bcfe737aa19fcbc0c509b1997
SHA1

c747d87c7811340334ad44776c3cebb4b4772b06
SHA256

e0010881f8738b3b02286822f1c697d7ad2b0c3db4c5cb842f2bca004355d217
SHA512

64641116236fe2fc31e62e02e8111efd2519b1cd5a150344684693bac2ea5985030058cb5331cf7d7c64a0bd05b84f51cb3df585613dd65c8f4b3c7897bbfaac
SSDEEP

3072:gY03ymoV57tys9FAAS/TFvEzhodQr4MJpwTOd49du2bXh+V+oxMlY:gY0C9VpEKvsvkibDhSto

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

Processes:

resource	yara_rule
behavioral2/memory/696-13-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/4004-14-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/4004-15-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/4728-126-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/4004-127-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/4004-309-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\F4A12\\FAC6D.exe"	940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4004-2-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/696-12-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/696-13-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/4004-14-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4004-15-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/4728-125-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/4728-126-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/4004-127-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/4004-309-0x0000000000400000-0x0000000000490000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4004 wrote to memory of 696	4004	940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe	91
PID 4004 wrote to memory of 696	4004	940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe	91
PID 4004 wrote to memory of 696	4004	940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe	91
PID 4004 wrote to memory of 4728	4004	940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe	100
PID 4004 wrote to memory of 4728	4004	940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe	100
PID 4004 wrote to memory of 4728	4004	940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe startC:\Program Files (x86)\LP\6D3F\35B.exe%C:\Program Files (x86)\LP\6D3F
  2⤵
  PID:696
- C:\Users\Admin\AppData\Local\Temp\940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\940d967bcfe737aa19fcbc0c509b1997_JaffaCakes118.exe startC:\Program Files (x86)\12EF2\lvvm.exe%C:\Program Files (x86)\12EF2
  2⤵
  PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F4A12\2EF2.4A1

Filesize
996B

MD5
68a0dffcb591939d9caa257a1c6d9bec

SHA1
d1c5638c11cbf83a966d2c6bb325f264f0cb86b0

SHA256
b182a7e9b47124c7fda1c46f55a4569765b88d4d6831d3a73a10692a3ccda6d8

SHA512
06c7779fbbc024914622754234a370ae16d320d4e72e82421a98f84c2f043a971828027a29bd1da3bee32858c4de907dc9b77639b4121eb12b2f605a4da31a78

Download Submit
C:\Users\Admin\AppData\Roaming\F4A12\2EF2.4A1

Filesize
600B

MD5
3dc4a04744fc5d9bf8c492228dafbfc1

SHA1
991f4b745eb9a130ead883d46dedbdfc0d654581

SHA256
039f95c781613b4f1b009afdb29671cb856d7c58dd08c5ce706b92e3f8cb7d0c

SHA512
947001a299b44440ebbb32289c5aaf3e0e5d398202d15ccb88a8f3e1712fd79ba0e5aecfaf5b90acb48077acac3a60b6096c153aa944a26be66f8a88f1d450f0

Download Submit
C:\Users\Admin\AppData\Roaming\F4A12\2EF2.4A1

Filesize
1KB

MD5
1b679f8dce825319a5903e94b0668872

SHA1
0a48a5b58f2002b9c63534907d3ddaacd61b98df

SHA256
41405aea216d8b86076aff58c7805700d3d47b39696e1481194cc8fa1b8dea5a

SHA512
69ed556677f968defca4e7ead1667ebe0a85648d8ab5c7b278a95f38eb1a51a250e915770fd2c5778004e2d4f711e5ffcbc9ddee72768a81837fa8862ac52b50

Download Submit
memory/696-13-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/696-12-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4004-14-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4004-15-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4004-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4004-127-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4004-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4004-309-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4728-124-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4728-125-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4728-126-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads