cycbot | b853a74b3d13056bf54211da6cfe3ec0abb997b940f75fceb66b0ec60937cf09

General

Target

d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe
Size

161KB
MD5

d0c38cd762eb6d565496f4271b05ecc6
SHA1

85a5819bf3b9afbdebc1d44ada6262475ec730b7
SHA256

b853a74b3d13056bf54211da6cfe3ec0abb997b940f75fceb66b0ec60937cf09
SHA512

800406d6a3eee1ec8e80ab180bb1511661200cc915598e7d03eb9b015e5b1808187f697d7ed605fc6765b165ed3309b7d2798deae8152dcc9db22309d5d0c395
SSDEEP

3072:owpq/0zyNk6Et4/rRZtkjzbXGMcU62IiuJJtsQ5:rthidOG/UmiyJt

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2372-6-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2112-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2112-77-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2672-80-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2112-180-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2372-5-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2372-6-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2112-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2112-77-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2672-79-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2672-80-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2112-180-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2372	2112	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2372	2112	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2372	2112	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2372	2112	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2672	2112	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2672	2112	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2672	2112	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2672	2112	d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d0c38cd762eb6d565496f4271b05ecc6_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E01D.219

Filesize
1KB

MD5
cc03218fa40a3463e5a77b3af02407b1

SHA1
f5698d5078e5c0da1e903aa2dfce67bfb946715b

SHA256
1b5093630903cba6b7c867830639ae6344df89cd699e792fb6eb00a23466d0ca

SHA512
7457ad731f6dffb76b6f04df14d23b860b03f587d0244b772c467831dbe7eb9e1e04dda3f9cf4319cc6b96eed1c9d4d81d7379dd38cc51de81b6971c1ca636f8

Download Submit
C:\Users\Admin\AppData\Roaming\E01D.219

Filesize
600B

MD5
bcfac3ad268edc22871c8f3dd9e3d132

SHA1
ce70317a85f61848c359fe5b58257e2bda9e5308

SHA256
eaa79389b41a0a46c184ca64359283c84b1e78c59c095193fdf8ef9f1fbde920

SHA512
2b0021056c991bbe95d5d4c40311bfc6d8f86c388bf752a89686a9f3a2525f3c73327fd15d238fc3d00ea0d729640de5ddad63603586097ff103ac799b3ee3ff

Download Submit
C:\Users\Admin\AppData\Roaming\E01D.219

Filesize
996B

MD5
18ee7414d97ee00d2712f58afffbbed4

SHA1
b08f593d64294d3757e94946207da7f67ea1daf7

SHA256
73cfac69cfd0105a7b9c7b9f22c2fcba26d5bcd3f7e0d7321488788f872a0a42

SHA512
f670747537afb520ccb119163a3140aba1538cd3e33d58cd4287009ead3cd04d8afe96ab22f7bfad187714e2befbfa6ccfb79941b83c6b36d6974d3abce370c3

Download Submit
memory/2112-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2112-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2112-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2112-77-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2112-180-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2372-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2372-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2672-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2672-80-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads