cycbot | 2b31e369ba3cdbd27e6b3ef96df97c1806bf9706f314b8eacdc8d0c3367aa480

General

Target

cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
Size

171KB
MD5

cb175fcf43bb0f07227ed60c03b7d4da
SHA1

ba04ded2d6f0651eff238736779830fca66adaae
SHA256

2b31e369ba3cdbd27e6b3ef96df97c1806bf9706f314b8eacdc8d0c3367aa480
SHA512

b3571444035b30e55b18c86d9e0cda0f68566ab60e174302e32f6c177b5f4347ae3e0f024af58c8a26d43e797bfe6e525e6d7b12831063ca51ecebf3be85382b
SSDEEP

3072:4cDdvnrlP7DZKO3p8tZT8uex1P0ofhTe8lcGcGKvHfYm0Yp8X/ZcD/Cs:4cDvP7kUaZe/0oUGcbfwdfXmD/R

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2648-12-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/3044-13-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/3044-80-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1108-84-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/3044-200-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2648-12-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3044-13-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3044-80-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1108-82-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1108-84-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3044-200-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2648	3044	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	28
PID 3044 wrote to memory of 2648	3044	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	28
PID 3044 wrote to memory of 2648	3044	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	28
PID 3044 wrote to memory of 2648	3044	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	28
PID 3044 wrote to memory of 1108	3044	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	30
PID 3044 wrote to memory of 1108	3044	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	30
PID 3044 wrote to memory of 1108	3044	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	30
PID 3044 wrote to memory of 1108	3044	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E5A6.BE5

Filesize
600B

MD5
112d270aaee09aa17008450e2f706691

SHA1
27beba58b4c48c5e1781b05ba98190cd6a232b50

SHA256
0b7c66ce29ce9e65c073997c09b8c68289915cc2ffa3e434700828797607513b

SHA512
2cd25e9bf1663a2bee65806ae1f7d5337c3b2ac361cb920cdd9a4318c2b15f4ae1e05b2275fca0ec828d1c351c212de099b5046b3641b7f1866ff119c1166e60

Download Submit
C:\Users\Admin\AppData\Roaming\E5A6.BE5

Filesize
1KB

MD5
3e2890de24896624168c5a077d0ff51a

SHA1
cb0da370cb61ac62666864afce71b4d8fade44fc

SHA256
654c69a3228839dcca5875c556aa437f6912bd9b105d5b2d559ad09a829caa06

SHA512
a06990175467525a1611371ac6f78e7da834a7361c7f2271055bc93b182a61dc2de497950b916d19204e5e7201ef9073c55e858c252a28c3c3dead2f50284287

Download Submit
C:\Users\Admin\AppData\Roaming\E5A6.BE5

Filesize
996B

MD5
f06c23776f9eb3c74ca3f5c47355d0ef

SHA1
f33491ca95b04fa4c5c822a853930babd9d28b1c

SHA256
97c4b87557d9004aef7106158944e07e0d86e289c5a0dcb497f9c5a032d2c3a3

SHA512
3df029c5377a34ad7a52b52b258a21cf379b7f7c101b4716aa9f28ff93685b0a7adf58d9d5d8087d89fc3443825cf4592c26a066bef672c806992f4341b3157d

Download Submit
memory/1108-82-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1108-84-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2648-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3044-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3044-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3044-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3044-80-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3044-200-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads