cycbot | 038b8576eaacb1ad875062a5cb55ea7644ec94b782c64788833e335886260315

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe
Size 180KB
Sample241125-smjzcssphs
SHA256 038b8576eaacb1ad875062a5cb55ea7644ec94b782c64788833e335886260315
MD5 9c4ca60a1f38c7ee35b9e845e4db2634
SHA1 1ca22c364ce7e77c40438a479bdfa613bd96a521
SHA512 e2dfa3a26d2a0c91a06f36561e8fc2822f49956d62027aeafc916bf9bf8af8d75cd9f899124c367358787181bf5b46568bf05960441e35bfa82c8dd57755038d
SSDEEP 3072:GzDLFxLLRfDXS4Pxm4sWWR/pEQ5qYFqGdcOxSUhj2R76GibW2C6uJ9Ra3DTmRUdz:GzD5rC6sb/F5BxZjs7LibWiuTkDyqdUx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3376-14-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1284-15-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1284-79-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1060-83-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1284-197-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1284-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/3376-12-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/3376-14-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1284-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1284-79-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1060-82-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1060-83-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1284-197-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 3376	1284	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe	83
PID 1284 wrote to memory of 3376	1284	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe	83
PID 1284 wrote to memory of 3376	1284	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe	83
PID 1284 wrote to memory of 1060	1284	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe	93
PID 1284 wrote to memory of 1060	1284	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe	93
PID 1284 wrote to memory of 1060	1284	9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3376
- C:\Users\Admin\AppData\Local\Temp\9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9c4ca60a1f38c7ee35b9e845e4db2634_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F0AD.C74

Path C:\Users\Admin\AppData\Roaming\F0AD.C74
Size 1KB
SHA256 9f872745f7068bd17dcc3780f48a60dec488308e41ce34d1763953dc34cbd1a9
MD5 8e9347840f60f274faaa398db9cc5e5c
SHA1 e9e7a4a15854e650f6428ec915c328d5252bab5c
SHA512 afafc3e72f4bce024c4fe24dc0ec4591fd9db7c7ac9dc8a9c3675ba63df0af39ab83fdd21f763005af99c8756658a4d878bcd3219f9a847aa1407567e2fb5464
MD5 SHA1 SHA512

Submit Download

F0AD.C74

Path C:\Users\Admin\AppData\Roaming\F0AD.C74
Size 1KB
SHA256 9061f4c488dc7bfe9235b7360c300142ff0d318b4179f937419a461eb9c0fa7f
MD5 0a277c2ee7f805ff23995d94acbb2cb5
SHA1 a65edf81f0d694de889ec581bc6169fed3bd4362
SHA512 24a6f059e1685d67e63f8c3b66c3f4f88db3990ccb88f5217806730d24c7c1bf154dfe8c7518a1acdf5c0179febb50f90c66b359db0739a99d2686ba501159ce
MD5 SHA1 SHA512

Submit Download

F0AD.C74

Path C:\Users\Admin\AppData\Roaming\F0AD.C74
Size 600B
SHA256 eeba174fb356fbb4d1ad22d333968ca241f06ae3018c3689ac6590d69d8bab03
MD5 b1d1a895485fc5f7cdfe9c1627fafbb3
SHA1 128150058d0907026eb665032497b229e8f8a994
SHA512 7d408e5f686ce7b5815224eaadc0211ed6d0eae692dd551b5402ce9cd502c8fc7b3d76dc86584f74728bc6686cca94dec37b1dbead985b8255180c628bfd4948
MD5 SHA1 SHA512

Submit Download

F0AD.C74

Path C:\Users\Admin\AppData\Roaming\F0AD.C74
Size 996B
SHA256 2a179a671376f0d6e8cbed3381e39a412ba97859a60d85d85282fa2604580fa5
MD5 f21d94ace5fb7342b1f57a303b741d89
SHA1 e4baa6734d05d316f5fd73e5e7d2815cb1186390
SHA512 508c00d8544eacabd07a1baa65455cc86420ca5ed79a63b2645743a794faca8bbf0fecfb583400e5489cd045fbdd368bd411ab643aa10297d48f8e9bd667aafc
MD5 SHA1 SHA512

Submit Download

memory/1060-82-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1060-83-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1060-81-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1284-79-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1284-1-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1284-15-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1284-2-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1284-197-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3376-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3376-12-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads