cycbot | 2b31e369ba3cdbd27e6b3ef96df97c1806bf9706f314b8eacdc8d0c3367aa480

General

Target

cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
Size

171KB
MD5

cb175fcf43bb0f07227ed60c03b7d4da
SHA1

ba04ded2d6f0651eff238736779830fca66adaae
SHA256

2b31e369ba3cdbd27e6b3ef96df97c1806bf9706f314b8eacdc8d0c3367aa480
SHA512

b3571444035b30e55b18c86d9e0cda0f68566ab60e174302e32f6c177b5f4347ae3e0f024af58c8a26d43e797bfe6e525e6d7b12831063ca51ecebf3be85382b
SSDEEP

3072:4cDdvnrlP7DZKO3p8tZT8uex1P0ofhTe8lcGcGKvHfYm0Yp8X/ZcD/Cs:4cDvP7kUaZe/0oUGcbfwdfXmD/R

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3368-11-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral2/memory/1996-16-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral2/memory/1996-73-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral2/memory/2268-76-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral2/memory/1996-183-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1996-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/3368-9-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/3368-11-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/1996-16-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/1996-73-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/2268-75-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/2268-76-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/1996-183-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 3368	1996	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	85
PID 1996 wrote to memory of 3368	1996	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	85
PID 1996 wrote to memory of 3368	1996	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	85
PID 1996 wrote to memory of 2268	1996	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	94
PID 1996 wrote to memory of 2268	1996	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	94
PID 1996 wrote to memory of 2268	1996	cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cb175fcf43bb0f07227ed60c03b7d4da_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1C27.A39

Filesize
1KB

MD5
d15ca19bf2118bed315cbde3e1a0ba75

SHA1
08c0b3c0a095d3fb25a16fc9c2f8f4582bd79957

SHA256
60afe1d27021a6490f3f61ea3a1368a03d35a66923cb9f798ae9ec8ccaf00449

SHA512
c501c888f84336c18fc3d4d770a8e5606adc7cae3af6d03eb3441914437daddbb2b6e9574253e401515d337d6b614ce4ca393d54069d9efd84947f406da94e03

Download Submit
C:\Users\Admin\AppData\Roaming\1C27.A39

Filesize
600B

MD5
72926a5c124f6e42181c55cdccf5a055

SHA1
bd4dbb5cee51f73ddad3f48a355ea97df338f8b2

SHA256
5810a4a2ef2738668d7173ea54c8e3ec04cbb7c9533df1db0bb2efa9a9d90521

SHA512
16a104662f917919bee0808ab904f164686af0567a1f0a3250a2659c72bc43899849d9d3e0e76630e336bf1d834bf6457f75ccc7c316753d860c1996628e1e83

Download Submit
C:\Users\Admin\AppData\Roaming\1C27.A39

Filesize
996B

MD5
61216fc7929a6c36c5cb50a47b9fbc00

SHA1
01600a87d5450784954e8969d3e9ee410f1dc867

SHA256
c596972be8487a6672f6f273624c0fbb468b13cbce0cc051cc2444b77a3c3303

SHA512
8b37fb1200b4a6eb7060b48fb306187e34902edb6ec499019223eed870a9e3f450704cf6214d20f6461416904683862073ccc571e3c1719831efc9f1dc9f17d6

Download Submit
memory/1996-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1996-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1996-183-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1996-16-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1996-73-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2268-76-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2268-75-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3368-11-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3368-8-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3368-9-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads