cycbot | d6d8194d2fa588da37951d70662111126c1a5fe736d4212a0892a97593192a83

General

Target

cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe
Size

174KB
MD5

cb59c6cca06dd80f9db08748bef46bfe
SHA1

4324492841f23b6eccb45950870cde4ba4607883
SHA256

d6d8194d2fa588da37951d70662111126c1a5fe736d4212a0892a97593192a83
SHA512

9238e77a97beaa10519803c915d7e3fdc9367125d76fd918b6b9deef00b4f8cd7cd8e4eb7a087a8be0ccd4fadfe5442fa95405a02bb0d76a5ffdc35f4e1fbe56
SSDEEP

3072:MVFTTcUFKpCpxR8/zdH24x8pwsyTF5EvOz0eTb1DZMRl+p:MVFTTcUFaKxR8/Q4x81igOz0KDZMX+p

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2336-8-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2336-10-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2384-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2384-78-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2184-81-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2384-196-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2336-8-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2336-10-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2384-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2384-78-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2184-81-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2384-196-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2336	2384	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2336	2384	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2336	2384	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2336	2384	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2184	2384	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2184	2384	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2184	2384	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2184	2384	cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cb59c6cca06dd80f9db08748bef46bfe_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E320.F3C

Filesize
1KB

MD5
2d26bfe485e9158197636e2cee3b4caa

SHA1
206e675b8b0cb41d3813f1e148783c55a0bff23c

SHA256
a5518ede2c39b3e8aa1ad2bb98ac263b768f436eab6e5d7de767be0e2d0774e9

SHA512
d2f70e33c9901bfa3a5b4dfa0123a3392397bfe7e3acfa958cb0ce322dd84062f5a3bb4f2d01cd3aa8e88d5e6d209af692c558bb18845ffef1e9269f6ae4a1b9

Download Submit
C:\Users\Admin\AppData\Roaming\E320.F3C

Filesize
600B

MD5
c2e0c6f6fbf594a3ca52f6aacb233c5d

SHA1
63be4ee57f2fd04253a5de5d708882aaf6a8d23a

SHA256
ca6954a098439c5107af839d2773ab97bf575b6170975f35cf474717204a9f89

SHA512
4fc5f403087fd7aeb79c5d7a56380159c2e1748a2b0945978bc6f86fb2250276ad582c7a68c2f054882a992e9a96077eff1cab0069a694efad1f88bf30714b52

Download Submit
C:\Users\Admin\AppData\Roaming\E320.F3C

Filesize
996B

MD5
d8afaba98ec32de8b68bec8f08c6a8f6

SHA1
077a26f3357d2ceaefd54e1d2327398d59c1d087

SHA256
d6edec6be40d3233d36453d50924999f8b0877a7a500af68a4e44b7275db2efd

SHA512
5407da4402f7eba52e849ff9b2389f985de22ef13f0670ad7a2a6cc527d4b26919a537a575b493cddc355c26d611d8ccceb71fed3568aa99ccca69e811106388

Download Submit
memory/2184-81-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2184-82-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2336-8-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2336-10-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2384-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2384-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2384-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2384-78-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2384-196-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads