cycbot | 7abcb122442fc8b1e8fb80e463336a610ff5fd97f8d5ce54d73edc7115324cee

General

Target

cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
Size

181KB
MD5

cddc97e06d8a0f6d3e8219cab6aba339
SHA1

899687af5dab92e9188289bfd494e62bcf7bc030
SHA256

7abcb122442fc8b1e8fb80e463336a610ff5fd97f8d5ce54d73edc7115324cee
SHA512

1070a1c3fb2eb29e960d23c0f4396ebef92712a01e25c0d4864ba8a9dbc107a7edbf137940704af2c3ec5a725f6fe3194b768e90ebc2508297cae9823c2d3e05
SSDEEP

3072:hOUZtgKbMExYBa34FApRK/sExDsapON9rkG1N/IaP9RbNObscXv:ICzbMEGApExoaoN9YKNTP9SQcX

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2836-14-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2268-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2268-81-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2204-84-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2268-160-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2268-163-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2268-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2836-14-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2268-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2836-82-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2268-81-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2204-84-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2268-160-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2268-163-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2836	2268	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	30
PID 2268 wrote to memory of 2836	2268	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	30
PID 2268 wrote to memory of 2836	2268	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	30
PID 2268 wrote to memory of 2836	2268	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	30
PID 2268 wrote to memory of 2204	2268	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2204	2268	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2204	2268	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2204	2268	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2836
- C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DB1E.8EB

Filesize
1KB

MD5
be2506b275847f03c67346459b9ac4e8

SHA1
9283920270212ca89140d9db2b97026cfabe0057

SHA256
a51f20233db1ffc1bf34f6895447a819a4e3cac45446b5693e55a54253b61745

SHA512
bbcaede25170508c6985793433a7f7dcb39a6cc97bec9ce5cb52bd0e686796a0252626c493a84c7c052b4d71cb3fd1fe566a46493549627f4f037181fff6359d

Download Submit
C:\Users\Admin\AppData\Roaming\DB1E.8EB

Filesize
600B

MD5
e43bb88ea445041f05176c324b696938

SHA1
d1f70e1f7f06154fdc4e034dc56f5d3d47b897e8

SHA256
a9038c1251f0a48f65ac4a5d711d1da70cc65ea811d662c342fd08796ecfd7dd

SHA512
edcbcffdf574caea7ebbac3d0af1ae1b532bd62876efc10ca9c8d7d98dc6ae8ccb6b0729fb95fb041e779c7f1f6b9a4370d5f258eb3c0d03602850acac82a9ae

Download Submit
memory/2204-84-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2268-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2268-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2268-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2268-81-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2268-160-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2268-163-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2836-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2836-14-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2836-82-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads