cycbot | f5b243c6087cbebafdc27c0f0c60937c24323dd17b14dd66ad9b90def4cb299a

General

Target

94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe
Size

174KB
MD5

94ca4dbfbbfb009322d782c4bab76879
SHA1

e49a604dbdc9e00c42f73db128b32eb708cd89b2
SHA256

f5b243c6087cbebafdc27c0f0c60937c24323dd17b14dd66ad9b90def4cb299a
SHA512

86ec57d9cf02b3058cc5d05eb7aabb43a51789c614641df139a45d3941a62e9a10d78c48ca6ea44cd200b8b58d8e1812044b0c330fa3c2d8cb162b993fab2cfc
SSDEEP

3072:4TyCGlKp5zhil/eMkb/31Owp5O9pFPPcJX4CtdyNgl2IOyx8DbZ:4TyCNpnu/eTb/FOwp5O9DPcJ/dyNm2IY

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

Processes:

resource	yara_rule
behavioral2/memory/3608-14-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/4968-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/4968-84-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/1716-88-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/4968-209-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4968-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/3608-12-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/3608-13-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/3608-14-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/4968-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/4968-84-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/1716-86-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/1716-88-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/4968-209-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4968 wrote to memory of 3608	4968	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe	82
PID 4968 wrote to memory of 3608	4968	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe	82
PID 4968 wrote to memory of 3608	4968	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe	82
PID 4968 wrote to memory of 1716	4968	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe	90
PID 4968 wrote to memory of 1716	4968	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe	90
PID 4968 wrote to memory of 1716	4968	94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\94ca4dbfbbfb009322d782c4bab76879_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4D83.C41

Filesize
1KB

MD5
ca7d62bb71940372bd8a73fd9c6710e7

SHA1
b8b39a07c9c12becbcc71f13e6a21f424633add5

SHA256
ffce0b6b1a9b03f549486384d2522466f56649afd69c62ce79a12dc3d42d34d0

SHA512
9a384ead058d8618e289f15e75f58d5365eb8b128aad5cd2840d5049683305e94d785629e8b3dfc72ab58865d7b45404605ac92f3fd22c16528791ff5384be1b

Download Submit
C:\Users\Admin\AppData\Roaming\4D83.C41

Filesize
600B

MD5
312bc3ebf068c73f265889455f5c2068

SHA1
e9d1b4a568d0325123f891d11fc46da84391002e

SHA256
2dccfd719fb211e9e5ad2dc6fbf7f4e561bb0f285891755b056c3777c32728c7

SHA512
23b37424a67d04adb03037e7de68a3e2997ab990652e6e02ed0640a5012dfa6ea8ae4aa8543c9ac389d0069ff5c687d0d326d78ac8ddcb73c4c26be87d082434

Download Submit
C:\Users\Admin\AppData\Roaming\4D83.C41

Filesize
996B

MD5
eea314112dccbc684f4fc2694d19e459

SHA1
67bfef766c60a298858707fe0d0f4124a1016794

SHA256
941f02f6bb2e7de9f086ac67d9f2dc97a6f3600b01a21c23dfcc580684a87a2a

SHA512
6e070bc7c82c5a141158efc89385270c38c8e99c079becc94acb84a2d24ceb7cc0ecd66bb1f1332ad76583aa9da7b980618df26b85d0d41342070b70c1335864

Download Submit
memory/1716-86-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1716-88-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3608-14-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3608-13-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3608-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4968-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4968-84-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4968-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4968-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4968-209-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads