cycbot | e5dbae70187ff48257f17536d13f7219731c9faa2bf41a3c82278457848bc9a9

General

Target

d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe
Size

157KB
MD5

d61d9f906c93eb2e54e522c3e1c97016
SHA1

92dc5bf4bb0d263ea8537d10d31b8c9f555f7417
SHA256

e5dbae70187ff48257f17536d13f7219731c9faa2bf41a3c82278457848bc9a9
SHA512

54d9cf8e5f85a3074ff35c13b7c251d9ba3d2e2a1c775605f19f49ebe70472f39c6dc4c7852598771a763668e60164623e2edc646aebf39ee0044eaabe1a8325
SSDEEP

3072:NpImIa5PWExNAcLuJjhW3fMA3sFctlRA3fG2/Uhd3tNLmvmR:5Ia5PWM1is3YFcfRA3fOFfL/

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1720-5-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2292-13-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2292-82-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2944-84-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2292-183-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1720-5-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2292-13-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2292-82-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2944-84-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2292-183-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1720	2292	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe	31
PID 2292 wrote to memory of 1720	2292	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe	31
PID 2292 wrote to memory of 1720	2292	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe	31
PID 2292 wrote to memory of 1720	2292	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2944	2292	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe	33
PID 2292 wrote to memory of 2944	2292	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe	33
PID 2292 wrote to memory of 2944	2292	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe	33
PID 2292 wrote to memory of 2944	2292	d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d61d9f906c93eb2e54e522c3e1c97016_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B0D1.760

Filesize
1KB

MD5
c3348535145f86d51d67fe2c02c9911d

SHA1
b6b8707e0bd3d4b2c02962fb1fe88fcda8243d64

SHA256
b1cca82a88b14ee7e65129e77d0b49ff801af0915e8eab56e140e311a7cb88ca

SHA512
fd2efd5af0006324f1c1b23f381683bfb011f2bc369b8d26e55aaec9d6928447abe68a3f96ddbce2bc51838381389bf9d06cdaa04e0eda1727a2290c8f71a724

Download Submit
C:\Users\Admin\AppData\Roaming\B0D1.760

Filesize
600B

MD5
a98da0642b1d5946d972f0c69a432f45

SHA1
d0143018535331784a590f046b866bce0216670e

SHA256
eeb6c92a04f59660f8b252e63c87d16988abcdc877e1c6d971688572f8e599fd

SHA512
66f6679368f10fc1747fe592d238338a2b1fd9c227de93b506d4e20dec79160165e32690fd7e189265e19a0ee998c30dbacbd8c22345f607a701010362a41b18

Download Submit
C:\Users\Admin\AppData\Roaming\B0D1.760

Filesize
996B

MD5
32bdf3c7feb85783e43678d1b98f74ac

SHA1
b00a341ab05a405c59d43fe789cd23ca9d44af57

SHA256
269ca5feb3131647f0c97960db1e1c1972aa096ff3267056c87fd413a5bf5f82

SHA512
81c7cffc038728a0cf618e6c89074cb6d85fcde592b8888b57cdfcc528dda5432c0befe09ef85edc42e80e6b0eaae8214e3a3dd60520f7e9ff7705ee6906fde6

Download Submit
memory/1720-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-82-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2944-84-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads