cycbot | 93c500600e4a24419a3558848efa7941c473a88bd1a7b47a428d59e2fa7e7542

General

Target

d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe
Size

165KB
MD5

d49d94af40aeab7b481e7b42b7dae302
SHA1

da76aa3018754acae1ef1900ababc7b7f0afbc7f
SHA256

93c500600e4a24419a3558848efa7941c473a88bd1a7b47a428d59e2fa7e7542
SHA512

80b67460c68c427d243a5031c3cc6811d8a19dc7b417b56db998f563bd65de7b1e1df4285a229872a309d015c3d29fec83074c9ba9c6686b96fa7d092481cd10
SSDEEP

3072:lBRqOlBpWvra62io4pwelGSGHoDhITmsHF8ivJCfpVtVfubeBKHM1904fPqu:PRVmLhpwwnDiTJ76Lub3K9q

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2940-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/776-16-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/776-81-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1636-83-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/776-189-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/776-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2940-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2940-13-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/776-16-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/776-81-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1636-83-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/776-189-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 2940	776	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe	30
PID 776 wrote to memory of 2940	776	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe	30
PID 776 wrote to memory of 2940	776	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe	30
PID 776 wrote to memory of 2940	776	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe	30
PID 776 wrote to memory of 1636	776	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe	33
PID 776 wrote to memory of 1636	776	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe	33
PID 776 wrote to memory of 1636	776	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe	33
PID 776 wrote to memory of 1636	776	d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d49d94af40aeab7b481e7b42b7dae302_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B516.14D

Filesize
1KB

MD5
8c25f9f2f2e3ef370ecc151ba05cdd5d

SHA1
705875292988cc165bcd5e836872298d9ecb04fe

SHA256
73142cd71dc84cd6bc7c1bdf9b0ddfd35522d03b161dcb025334bd1d004cf7b3

SHA512
31b2f05bbe60e18a093e9797087e31af076f62749bb74c22ee68b7317d27bb3d598de4fa6f9043ffb0388a4354c5ce26a19403bad963e43ffcd68ec4bb2c0f7d

Download Submit
C:\Users\Admin\AppData\Roaming\B516.14D

Filesize
600B

MD5
e56b919560a72344d61661dc58432ca0

SHA1
c14b7b3b901c937324bb9514a201d0325d5fc2b9

SHA256
cf1e9d5c8a3100fa5263e32e4d6fc22a2c34d91450ba26abc5b808859f05618a

SHA512
2de435464dcedb375ad1b34c683d6fbe4e9de951df14c2afdcc44f953d3e92883b30d269420f4cf7f63ac3aef362ef99054f2392745e6a74bd55b1d826522a15

Download Submit
C:\Users\Admin\AppData\Roaming\B516.14D

Filesize
996B

MD5
bc122ea50707ab884adc4e3b87120988

SHA1
96384b04ee655bf3add759074b133270efc2cf93

SHA256
5f4f532e58a5cb2fd8e75ca44a0d7a091421eb7b7b45fb14c7dc274052ab2691

SHA512
1bca9a8880e91fe9f192b82045ec0bfe600aae62a01df3251cb6f06d67019e8a7b501c1f033fcefcea05b66e70ed6d2ecc6d270783082b8f8ff2eef0576f5807

Download Submit
memory/776-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/776-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/776-16-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/776-81-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/776-189-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1636-83-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2940-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2940-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2940-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads