cycbot | 31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095

General

Target

cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
Size

165KB
MD5

cd0e91bba7713d1a7c66d50c4f9aed90
SHA1

fc4dde2537881ce341b8054fe64a9659a235bfaa
SHA256

31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095
SHA512

2a1eb564056bb3ea26d4ec36ba1c88482ec7fb26b788dbcde7389f654400403519d0d9c82ec544694e668ddbebba0b3a28ca4e70bf0e452764a6b5ada50615a5
SSDEEP

3072:EfkfcHxa/ZrtSBnZ+k2/d7V2g855t1dRTvydaDgA+XtZ4X:akfcHxaRhS7+kId/85zLRxgAiZ4

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2324-20-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1684-21-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/536-94-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1684-155-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1684-167-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1684-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2324-17-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2324-18-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2324-20-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1684-21-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/536-92-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/536-94-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1684-155-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1684-167-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2324	1684	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe	28
PID 1684 wrote to memory of 2324	1684	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe	28
PID 1684 wrote to memory of 2324	1684	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe	28
PID 1684 wrote to memory of 2324	1684	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe	28
PID 1684 wrote to memory of 536	1684	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe	30
PID 1684 wrote to memory of 536	1684	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe	30
PID 1684 wrote to memory of 536	1684	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe	30
PID 1684 wrote to memory of 536	1684	cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\38A1.878

Filesize
597B

MD5
178fb5f6909ca4e576cddf3e16612df1

SHA1
64591df7ccb021fe012c68100968a4db95e4a374

SHA256
dc40162ebef08c2e3ddd1694ae8e84304831d434bb0f62b261acba5fc39997df

SHA512
4442b6f720c55be6b6b9308d1ee4a3ae91a8ca1a854882fdc21b0169b33228fb331b1dcae5bc10f4147d8f8ef41d2771ba30780b74e1368e942c4e281fa5d087

Download Submit
C:\Users\Admin\AppData\Roaming\38A1.878

Filesize
1KB

MD5
5e010bcc94abd6e6006f7a86f9daef3d

SHA1
e7703d42605b859233b4ce8e63d354484e209d9b

SHA256
daf6917e27d91edc5267fcbb570486e2f19e1d97c73ca7e3fb953db49b7494c8

SHA512
c2762e4fc47343c3996d105f62bad32ed9c185b5f9d5f623fc3dc188cae93a11b90f3e14dd32d2ec2c249df82892f61d4b8d0f9ee6b2ceaf1821202fabd42c27

Download Submit
C:\Users\Admin\AppData\Roaming\38A1.878

Filesize
897B

MD5
1ab8821b6fbf6f824c533a3a24f70c51

SHA1
452f8849da7e2085a55bdccbcc996362097a3342

SHA256
f2b62a18a8f69d89bbdb28bf9503a5961679b70a4adcd070a321e33e1d76db77

SHA512
ccfd1757cdb3ebc013423c58b54797108886cb69c76e51a12e724774b15bdab9b906ce4a7a82b5e23cf0b1889684b3f3039838b3a8e56703857f235ba7291c8f

Download Submit
C:\Users\Admin\AppData\Roaming\38A1.878

Filesize
1KB

MD5
c5d792b664812063ca4df6d226f53dc6

SHA1
5e583abfc5e77771c09dc4d273401646e7bd8d1b

SHA256
ef7f6d3a51b7d29ca15ee2a0d93765996db1616bb92e5692fdcef6092d95a9f2

SHA512
fa38eef8dbbbc6e275f5f7c12099370b65791020d9813698717fbebeb4bb2c1f5c3d9b9798438e32f5d6909536f361908e4ffe6f2fef549fa6c92b807883b232

Download Submit
memory/536-94-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/536-92-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1684-21-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1684-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1684-155-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1684-167-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1684-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2324-20-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2324-18-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2324-17-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads