cycbot | ca873c83169b6e3143a6eb78a812241ae9a88bae50bec3832c0df0815c2bffd6

General

Target

cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe
Size

176KB
MD5

cca84829dde5696ba97397cfee06d180
SHA1

19a3d095c83cae37f6deaa5edbfe7143c13bdb14
SHA256

ca873c83169b6e3143a6eb78a812241ae9a88bae50bec3832c0df0815c2bffd6
SHA512

368ad3bb998ffc8f030616f3f9ba0cfd6e2847ac6f98f83342e868ea7f214c0a99c01a6659fee1848c225690cdc99db91f3eb63059710ad02cfe61ea96bde186
SSDEEP

3072:bRC/UmzULMWQzL8+j+Fegyht8y7dTMiT5NrAvLs0pne8gRQ:NPmAMWKo+S0rv8ytMsrAvIbRQ

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2772-14-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/3040-15-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/3040-80-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2908-82-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2908-83-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/3040-84-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/3040-185-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3040-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2772-14-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2772-13-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2772-12-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/3040-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/3040-80-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2908-82-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2908-83-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/3040-84-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/3040-185-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2772	3040	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2772	3040	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2772	3040	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2772	3040	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2908	3040	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe	33
PID 3040 wrote to memory of 2908	3040	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe	33
PID 3040 wrote to memory of 2908	3040	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe	33
PID 3040 wrote to memory of 2908	3040	cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cca84829dde5696ba97397cfee06d180_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0E2A.339

Filesize
1KB

MD5
10339a82f3ed3ad191a232ab06acdb27

SHA1
079d15bcf02572f0df03e81cc02ccbdf9eab7723

SHA256
33d4a8d55ed69097db91993b2494764290c299151ca180554032f6f768446bf1

SHA512
0036ffc28ff04b573a6606b9e5cf8fb104cb95884f3951e095b40bfadc82ebd26ede3495c7b205f162f86a9d8ad62e828d2d79cec9305cf186d9455f3a919a95

Download Submit
C:\Users\Admin\AppData\Roaming\0E2A.339

Filesize
600B

MD5
3219e6ce1a856f7811a79a3a711bda3a

SHA1
a3240a467f46fb35b350a53145b8fdcd590ddd84

SHA256
87791a613cfb004835c7a16f707d861b610830e5aba70544ab8071698b144129

SHA512
1ec853da006d6038deacdc579a0c92608422eca97ab1d81a9436f94c267200fa47aa47e834d9bd539fa0bbafa97acf696b8e7137ab5722d59dfaecf4f400301f

Download Submit
C:\Users\Admin\AppData\Roaming\0E2A.339

Filesize
996B

MD5
4941e40e0f1492827a9c77ceb3b41037

SHA1
77dcfb7594b7f64e4beb8f46c638fcdecd0e888d

SHA256
a56289286311171bbc9510b97ed4f835d8d7e96fae2f09cccaba1bccf0382e89

SHA512
0b26cdfcef48f382ac502189cc487ff99e204e9cd13daf8ae8edaf9180028f471ff0e6851335c62494ca14644f3afe8eb6c880306c6ddcc9b1587c9c4436fa81

Download Submit
memory/2772-13-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2772-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2772-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2908-82-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2908-83-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3040-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3040-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3040-80-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3040-84-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3040-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3040-185-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads