cycbot | 26260ccb8ea9cefded3a95e26c24f2a20e680392b3dd054662b0485eecab2249

General

Target

cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe
Size

201KB
MD5

cf5f69e23f406b38d72266892123c5cb
SHA1

681d2b255e468463a9b385e80a4fb29f544f28d3
SHA256

26260ccb8ea9cefded3a95e26c24f2a20e680392b3dd054662b0485eecab2249
SHA512

6daa9ccf3583bbb2c09d7697e9c179542686c434394e4b423a7f34aa5c1293a8a72868442de69060871d12f40a029f685998f86baff4a0a7d43750c26000bd84
SSDEEP

3072:O4zJZIMtTS8Atp7wfP0KlrzlTL2yLiCtfUJ9ykRZd+k3U6ABS+0:O4fBtm8AjkHPlrJayLiKUry2ZdNX

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2308-14-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2480-15-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2480-82-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/3020-86-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2480-187-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2480-2-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2308-12-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2308-14-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2480-15-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2480-82-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/3020-86-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2480-187-0x0000000000400000-0x000000000048A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2308	2480	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2308	2480	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2308	2480	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2308	2480	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe	30
PID 2480 wrote to memory of 3020	2480	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe	33
PID 2480 wrote to memory of 3020	2480	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe	33
PID 2480 wrote to memory of 3020	2480	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe	33
PID 2480 wrote to memory of 3020	2480	cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- C:\Users\Admin\AppData\Local\Temp\cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cf5f69e23f406b38d72266892123c5cb_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\59B7.3DC

Filesize
1KB

MD5
87fdf0fa4af214ea3385f254c4b8c16a

SHA1
5819ff01d234d883855b9f26386bf5ea7b2b5ae2

SHA256
482364b3341df0fa7c524e00fc6752b23e8466dde93cb1e4a864fe557304b12c

SHA512
48639cd2159147130874f6977fd4defe04374fc0737e40b961d3427aa398cc95eb12deee8b90bed55f3492770fd8e4b28e2f12ec4f25892accdc56baf0df70d3

Download Submit
C:\Users\Admin\AppData\Roaming\59B7.3DC

Filesize
600B

MD5
e859de5ef1c9c3019279c3fb6033ce72

SHA1
d583f4558f09a56d0ea9ba3946010eeb822bf3f1

SHA256
b7f1fd79395881062f9a7ac7b09e5fa7b59b68182f6b6972a388b8ce9f525409

SHA512
c37e3ae94694d55beecfb14ee7ebdc12ec68ab1c16c42903963d3e89fe3850c5e3efabe6a2e721238101c720628fb2a35c0716501c17db8598797bf129cd705e

Download Submit
C:\Users\Admin\AppData\Roaming\59B7.3DC

Filesize
996B

MD5
80c03f850a73528d53f583c9fda451e8

SHA1
f6e7c34b0f1d0fb32867942e0f836848a6ef0830

SHA256
34e70cbdb6b787e79a0117957cc1af54af9aac01302d9281a568519e12c5a2e7

SHA512
258c609be78e980cfab7d9c2972a515ba6d1ce3530ca8be12dec6eb2022cb525c54fcee1f990abc13d073c205a6cb6c66156bad2c2e1e57f3f53f47825acde5d

Download Submit
memory/2308-12-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2308-14-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2480-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2480-2-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2480-15-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2480-82-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2480-187-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3020-84-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3020-86-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads