cycbot | e656c8fcffe3d4d8aa4702dd9dd313cee0af4e6192f0551751bb72b55e075eb6

General

Target

c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe
Size

189KB
MD5

c563736c91d85771c5f0f69e34377a39
SHA1

9a4fce814020686662d5efe6d703319e367140cf
SHA256

e656c8fcffe3d4d8aa4702dd9dd313cee0af4e6192f0551751bb72b55e075eb6
SHA512

996eb8e63b3f55cd5820275e81a0772355be3db9bf2c4f93a5b500c1033afd15120fa9e05c0a72fbbd2e9fea2fd5e9c17d442a258c31b1bb6c5dd71b4fa26bb6
SSDEEP

3072:HmBOfy3tLGb8uCzMkNxbwzVyUsSxowgVpYWjshXX99DKGavdoZP6n6i:Zfy3tLaCzjPWVrOxaKGavWZP6n6

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1644-7-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2880-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2880-78-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1224-80-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2880-192-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2880-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1644-6-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1644-7-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2880-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2880-78-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1224-80-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2880-192-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1644	2880	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe	30
PID 2880 wrote to memory of 1644	2880	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe	30
PID 2880 wrote to memory of 1644	2880	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe	30
PID 2880 wrote to memory of 1644	2880	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe	30
PID 2880 wrote to memory of 1224	2880	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe	33
PID 2880 wrote to memory of 1224	2880	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe	33
PID 2880 wrote to memory of 1224	2880	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe	33
PID 2880 wrote to memory of 1224	2880	c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\c563736c91d85771c5f0f69e34377a39_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6DB9.FF7

Filesize
1KB

MD5
573b92406ef986dc266a4692ec752c10

SHA1
4d01dbb91bf75987bbfa39aab55f2e961a1dc332

SHA256
b23e28b57fe8cba6d33f79cb4ae1356b33f17bbb33d83724a1b0855eca70c73e

SHA512
3f27790aa28e4a3bdef884da3da01ac2690429ccb3cd23457bcf01a9a2218e0610b5b8fef5e9e1676eaabbd4972780b0e9d509093ee2f42c188601116b3ab8b6

Download Submit
C:\Users\Admin\AppData\Roaming\6DB9.FF7

Filesize
600B

MD5
97bfd644d49244e873279ba677d2f9b0

SHA1
3b13e06272de031a5917410f21bf9229ebd6850d

SHA256
32b01323541c9ad90a23824cfccdc956c5f067f0c72227b652fdfb6d5b44f129

SHA512
05588215a26b73f534e69e3161a5fa02320fc9cfc3dba458effc1cc9f117765aa10d79cd512aaa366198edd45c686c83b153f6ad10de21c140a74bee078a2f86

Download Submit
C:\Users\Admin\AppData\Roaming\6DB9.FF7

Filesize
996B

MD5
1f4d630dbb256f90f67e1c40398c422d

SHA1
92babe810d6bd793a563de554648e629599398bb

SHA256
679f147c60fc984d50ab8ef4da288dc0428f3730e2892fe1e21c859231cd8edd

SHA512
81bfc6b256f67772c777ce2b870c33c2c0163f3188c342a4957a22dafb1d88f894de5e73ab946592ac7519f995c15566ff04af4ad4481306498d61a1b13e674e

Download Submit
memory/1224-80-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1644-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1644-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1644-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2880-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2880-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2880-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2880-78-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2880-192-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads