cycbot | b3eb2538a50c478cbf360a8bdee4bf971a2cc7a82a479abe6c882719162cabef

General

Target

d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe
Size

164KB
MD5

d0d4545e1f9fcfdbc67b679dc32c718c
SHA1

bb21b190d0d2ef313db2921277fec30e1597ad05
SHA256

b3eb2538a50c478cbf360a8bdee4bf971a2cc7a82a479abe6c882719162cabef
SHA512

6796300b56cbd3136e34b88ad7a07ca2340d846d253c9bc270b0403a9d0ed69244915c5136da6b716e38eb9aebca478343a7274756a6d1204126bffb4d5a0999
SSDEEP

3072:dCqJsI6QYT12ti79DTgx1GFa1b6ZtucXmVSGy5gKxy77UsR4csg22AX1KiDgqykk:dCk4QYTbDS1z1S46kSGyaKU7T/V2bX1+

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1452-13-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2692-14-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2692-79-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2732-81-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2692-150-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2692-2-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1452-12-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1452-13-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2692-14-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2692-79-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2732-81-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2692-150-0x0000000000400000-0x0000000000444000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1452	2692	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1452	2692	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1452	2692	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1452	2692	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe	30
PID 2692 wrote to memory of 2732	2692	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe	32
PID 2692 wrote to memory of 2732	2692	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe	32
PID 2692 wrote to memory of 2732	2692	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe	32
PID 2692 wrote to memory of 2732	2692	d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d0d4545e1f9fcfdbc67b679dc32c718c_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F280.989

Filesize
1KB

MD5
ac9e52de01c273a6a8148c8a53e058aa

SHA1
2a3015229f5364cd449bf5740bfc934a09d85501

SHA256
87cb737340873d3e11860621c9f155e9e7170fd8270bc14a54b4dbcf5bc35089

SHA512
67e514affcd71614157828cd1d54dce7e2a0047cb0a5a31b3c9549ce044e96ec17ccfef7935daa0253a6a63108616d85e4820ec1c382bb2883486350af43058e

Download Submit
C:\Users\Admin\AppData\Roaming\F280.989

Filesize
600B

MD5
7ebddf0e2a09c707c82c81554e72b16d

SHA1
2858924f329b66fcaf911dc1cb984ae9a54aff0d

SHA256
fd36476ca5447b7dbe32da0092320e1fb4ca6b498e61199168e6add4abf90adf

SHA512
99326ba6246aa2c29384678a11982e1212cba3656b066775d7a10451a7c1b43568253a2b1c0941dfac06a20c55461bf707e02eb6e83772fac808f955cde3b179

Download Submit
C:\Users\Admin\AppData\Roaming\F280.989

Filesize
996B

MD5
d8f9a127c74b30b240dddd272217efd0

SHA1
6b234be11f20cdfec1b70084e18cc0e2c44a7d94

SHA256
83780e9314b7638ef6f52fec15d984af7a9ad9ee2c46adbfbde31034b6e11410

SHA512
b3bc29760c47197a87275c95019ef4a3be38d4e0709ea57c33fb193debfcf674b1a786e86b32e6f530f4ac0c69d81e2e2c7b2b56bdd96cb3a579124066c0ea4d

Download Submit
memory/1452-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1452-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2692-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2692-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2692-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2692-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2692-150-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2732-81-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads