cycbot | f6155095f14cc52bc2cb158b515432e5de31bebdab823b4b9e86a0433c589720

General

Target

cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe
Size

204KB
MD5

cbaa6d8a5ee7a4490d41467ccd455e2d
SHA1

0be47111b8c33ca392c024be97ab98a7b7570103
SHA256

f6155095f14cc52bc2cb158b515432e5de31bebdab823b4b9e86a0433c589720
SHA512

44b5f6c46f49f6f51d346e0be01fcb3f59f5fe563be7e4a80d4c71a4e2375d328bf58447df91df23ec54a63b72d08fb33bb2107271cf4f094e79007ead78daa5
SSDEEP

6144:AxU3ol2HZlQGjdFX9/oAz84Ftpzk+JWL4:pq4lbFt/BdF1

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1924-6-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1924-8-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1692-16-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2320-74-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1692-75-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1692-179-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1692-2-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1924-6-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1924-5-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1924-8-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1692-16-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2320-74-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1692-75-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1692-179-0x0000000000400000-0x000000000046D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1924	1692	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe	30
PID 1692 wrote to memory of 1924	1692	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe	30
PID 1692 wrote to memory of 1924	1692	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe	30
PID 1692 wrote to memory of 1924	1692	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe	30
PID 1692 wrote to memory of 2320	1692	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe	33
PID 1692 wrote to memory of 2320	1692	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe	33
PID 1692 wrote to memory of 2320	1692	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe	33
PID 1692 wrote to memory of 2320	1692	cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1924
- C:\Users\Admin\AppData\Local\Temp\cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cbaa6d8a5ee7a4490d41467ccd455e2d_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6E70.171

Filesize
1KB

MD5
07c0dd847e6c151dcd7497f9b666ed31

SHA1
fd71ad2e7dd1624776ff94c47379b2439bb6f39e

SHA256
5876b3ed47ff8726b72564ed90e430520974a084f4c211ddcdbc5c98cedd4e84

SHA512
d1104a56d5b291f2575af635576d1605fe61c6bf68845726e78a9a4af2c077bb8cde06eb2ed1f49efb8cb5a50eb5c6bab446b3b9a1df07784b8a54b6517c87ff

Download Submit
C:\Users\Admin\AppData\Roaming\6E70.171

Filesize
600B

MD5
8b4c6f86d29762efe30424b2d279ecbe

SHA1
4d785c126ce513ec1eadfb2acb30bdfef694d210

SHA256
e7c97ee78c7ba34d231c479d3ad6e1bc09d9c62e5e13305f4feb634697cfa544

SHA512
81868596a27b0fa3547437443b1d0c2d68060e0085c32fd8634cda0a7a646ff2ce055aae39fd7e156eab73489e437849b95bd8f1b4e27a59b317fc6f192e62da

Download Submit
C:\Users\Admin\AppData\Roaming\6E70.171

Filesize
996B

MD5
1d95e593ce0b7c951581cb724ffcee84

SHA1
b7f4b36ea748a4b994dc94009b808765e7379322

SHA256
72573227e8b2da5c5cca69b3618eb913a02a8100239056cb469b370733736ba8

SHA512
bd36f433e6f5d6265d85594848ed36b898316e78569b37f019663a2cf596f1a6b32e916324529ff539237be518c64b29526f23a2a9b26e172db3e25fc242a7ca

Download Submit
memory/1692-1-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1692-2-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1692-16-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1692-75-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1692-179-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1924-6-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1924-5-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1924-8-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2320-74-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads