cycbot | acc481cc760cac57a034e9932d3f2d470c68f8df183963660a2009d650dc0b4b

General

Target

d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe
Size

179KB
MD5

d0ba47b970fb65ef49b3b3c989dab7f5
SHA1

0ca01adac0e147aab06647c272a815010b953769
SHA256

acc481cc760cac57a034e9932d3f2d470c68f8df183963660a2009d650dc0b4b
SHA512

9676554802bbb428d8486708c273dd9f3764b5ad534c7d225aaa42d32b6e11130fef3e6bd0c5d501d3d088705ccecd2e2c0c592cf5ddedb4b3b4b0158dc5632a
SSDEEP

3072:Qvpp4K6gHfihdTAMqciIrCRSSINuE4uVmqfWVpkmvFbYdupGb3HSbtLnlr+6Z6nZ:yH46HfihdTAMsIrCvhE4uEqEvFbYdefX

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2984-8-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2172-16-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2172-82-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2888-86-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2172-188-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2984-8-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2984-6-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2172-16-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2172-82-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2888-85-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2888-86-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2172-188-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2984	2172	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2984	2172	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2984	2172	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2984	2172	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2888	2172	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2888	2172	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2888	2172	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2888	2172	d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BEE5.03A

Filesize
600B

MD5
b7008342a7ffe68c1fb5e5a4f42d871f

SHA1
d61884ff48eab579f8c248d42b664f8c70523c4d

SHA256
e757e4bcf40421d39c5c0606a2614e3969aa9640b06b67210dca92484b4d0e0f

SHA512
ad7ad1a684ee4c9a3224c2acd2fe4c96f16ddbd2a14157913bf52b88aa25cb136f767433b5f799b4d177e234df1aeac41b7b26a7d6d11721754059f8dd2f3208

Download Submit
C:\Users\Admin\AppData\Roaming\BEE5.03A

Filesize
996B

MD5
3a7a4645f7c8419d5082328689710054

SHA1
032d176284b12054f36b122334d3d4f712a8e99d

SHA256
973ea95f42d06b15dac389da71bd86548f882195a7e8b371fdb571a62c44e0f9

SHA512
360cd79b9b2c085eed7a3608f8853b72d86e4f712fabae68a58d69da8eeed9f954f354e84d7e07944bcf07102b15bc3fa9a320464d32129562a191f34f53bfc7

Download Submit
memory/2172-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2172-188-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2172-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2172-82-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2172-16-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2888-84-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2888-85-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2888-86-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2984-6-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2984-8-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2984-5-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads