cycbot | 7bc2d42ea9d50ec35613c734f23425e5cd76da7351579acf4d87420def398b53

General

Target

ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe
Size

186KB
MD5

ced1f01a9493b7e7c71009ae01d3751e
SHA1

10ba64e83ddbff3699f0e59460da6295d2bed8c9
SHA256

7bc2d42ea9d50ec35613c734f23425e5cd76da7351579acf4d87420def398b53
SHA512

88879b54560edf816d6799a4b86fd7cffeb584fbfe0c94701cd71e52b78709aa0081d3a284c197e69e776f14a3038aa993d55ce64955bee65d76338deda928e7
SSDEEP

3072:zP3WsdS1L203WShsHCB2hxJhltdN4CxQOKN6qwygOWnqqaa6oD3cCyTu8vcPIbR:zPGFp6HCaxxTN4i+6qw88qqaa6ecJTp/

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1576-7-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2068-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1656-80-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2068-81-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2068-176-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process
PID 2068 set thread context of 0	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe
PID 1576 set thread context of 0	1576	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe
PID 1656 set thread context of 0	1656	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2068-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1576-5-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1576-7-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2068-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1656-80-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2068-81-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2068-176-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1576	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1576	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1576	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1576	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe	31
PID 2068 wrote to memory of 1656	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe	33
PID 2068 wrote to memory of 1656	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe	33
PID 2068 wrote to memory of 1656	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe	33
PID 2068 wrote to memory of 1656	2068	ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ced1f01a9493b7e7c71009ae01d3751e_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E94E.81E

Filesize
1KB

MD5
5eec4fe76b03a6a5cedb346918e4ac41

SHA1
f233e98d3435a4509268cf272af1b31ef93f3530

SHA256
5cc8f4575cfd5155ead8da4f1878acfe0e81901d368df661ef37746778bdd640

SHA512
ce0bfb6d2237c3a0a60194840634e8a74abdaaa5b23163f426fef8d985f5119cd5898c9d286cb5bb27bbb769fd8084b726a2a63b0a4125df97a5bdbceeb33171

Download Submit
C:\Users\Admin\AppData\Roaming\E94E.81E

Filesize
600B

MD5
8c935bcbddb1f5c6cd5e842af0521d97

SHA1
9909232470b808f127daec7473baff4eed4ec6d7

SHA256
4cc49a70edfff5984950209f4c952f840c4cfe67d2edfbc5769800799d718ea1

SHA512
de81463e3e0f91be551bc28908101b6977626d5cddbf21fc78b780febcc8e66115e3d60b252b15a358676ce7a2d1577914ea868b1df3db04b0c6c701547ce93c

Download Submit
C:\Users\Admin\AppData\Roaming\E94E.81E

Filesize
996B

MD5
d7d2678a231767468f4c83a5d0e4497b

SHA1
2531fd6130e5eddc105d97d7c358ef9703dfabcd

SHA256
1a724783c0d36dd7d55ae720f55243ba3bcfd5ecd9442e9a6f7b573e0ef0020f

SHA512
5825230b2208f261a628bf6597727d5fc5e0f4a25fc3d28b3701562bcc6888aa55c0c8845a6b4eb324e98373de88ebe1ca958f66684f2a2c866bed2fc6c49200

Download Submit
memory/1576-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1576-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1656-80-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2068-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2068-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2068-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2068-81-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2068-176-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads