cycbot | 7abcb122442fc8b1e8fb80e463336a610ff5fd97f8d5ce54d73edc7115324cee

General

Target

cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
Size

181KB
MD5

cddc97e06d8a0f6d3e8219cab6aba339
SHA1

899687af5dab92e9188289bfd494e62bcf7bc030
SHA256

7abcb122442fc8b1e8fb80e463336a610ff5fd97f8d5ce54d73edc7115324cee
SHA512

1070a1c3fb2eb29e960d23c0f4396ebef92712a01e25c0d4864ba8a9dbc107a7edbf137940704af2c3ec5a725f6fe3194b768e90ebc2508297cae9823c2d3e05
SSDEEP

3072:hOUZtgKbMExYBa34FApRK/sExDsapON9rkG1N/IaP9RbNObscXv:ICzbMEGApExoaoN9YKNTP9SQcX

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3512-14-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/736-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/736-84-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/4024-88-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/736-198-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/736-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/3512-13-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/3512-14-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/736-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/736-84-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/4024-86-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/4024-88-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/736-198-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 3512	736	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	85
PID 736 wrote to memory of 3512	736	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	85
PID 736 wrote to memory of 3512	736	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	85
PID 736 wrote to memory of 4024	736	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	92
PID 736 wrote to memory of 4024	736	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	92
PID 736 wrote to memory of 4024	736	cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:736
- C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cddc97e06d8a0f6d3e8219cab6aba339_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6FAF.E52

Filesize
1KB

MD5
979944758e86c806cdc87331c67d2367

SHA1
40a04a08aabf1144741bc579a5c4687873fe5f21

SHA256
58700b65be857f06eed85146ca75861644d3f5c7a51fc6b9c1a247bab664f892

SHA512
1551327fba460a034e513a3cf4ad517f793ae8446df89edc90a8bb604e14ea3314fe668c43d81bedae91fee04246c84fbfed31b7a74bf8b9544dbfb8e0ee89ad

Download Submit
C:\Users\Admin\AppData\Roaming\6FAF.E52

Filesize
600B

MD5
a44614154ab514f9d9427fac92ec7ced

SHA1
ccb914a11d402ef90de3dd71bf0a762a2ca81b16

SHA256
cf5d5cb1b93144191c3666d24e56e88db482d6cf5423c1b76635720fe5b1eb62

SHA512
3a412ef8e80c4ab439d43a81bc6d9b8427a4d25542a4fa737c71a2ee3181d3fb1685d515779a5d07f4113fd415be0c470f582689edd93ac434b61701984c412b

Download Submit
C:\Users\Admin\AppData\Roaming\6FAF.E52

Filesize
996B

MD5
f0b9ba24f0772c1a6f9c3815cfb93b13

SHA1
2d63d03fa285c44d3b9a05bf33f8400d6dbde5df

SHA256
4b7ce046f0545f33b4c6193370314d050bb67de056d41a22d708b75d385372f6

SHA512
69f2533d1ede2eb1c5a84ee5d581140f84e4225a76c85982388b2e83f068ad7bd9fd780fd9f35ac8fb91f74e3ac57c2a283de08d97308589efc02ed4165137bd

Download Submit
memory/736-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/736-198-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/736-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/736-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/736-84-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3512-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3512-14-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3512-13-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4024-88-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4024-86-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads