cycbot | bcc0d4497e6ac32a89d86f2c74576f8e9d6b0fb2c2cc1de9c990da62efbf0c4d

General

Target

d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe
Size

188KB
MD5

d843ed7797a1b6badb49e470fc1c3bf5
SHA1

52677bf39bf135cc1ba20bf977a9d7a66380a275
SHA256

bcc0d4497e6ac32a89d86f2c74576f8e9d6b0fb2c2cc1de9c990da62efbf0c4d
SHA512

52ccc0c1f91c3fa40792b6de56739d06841970b05545a95b1def99c7ff19d110fc461ccc50f6d0362f4787944d8e7c34067d9ac3b14850affed251e1e1ebc7c0
SSDEEP

3072:QTSaJ22Emo4VEY7Ia6Cc9GGlVPNmRqKt3rDoRaSTZ8fMZYr2XYDokydjfksS6tpv:GSaJPEmo4WuV/c9lP4PtDXmZBZYqQobP

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2896-7-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/1688-14-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/580-76-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/1688-77-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/1688-180-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1688-2-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2896-5-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2896-7-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1688-14-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/580-75-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/580-76-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1688-77-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1688-180-0x0000000000400000-0x000000000048A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2896	1688	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe	28
PID 1688 wrote to memory of 2896	1688	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe	28
PID 1688 wrote to memory of 2896	1688	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe	28
PID 1688 wrote to memory of 2896	1688	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe	28
PID 1688 wrote to memory of 580	1688	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe	30
PID 1688 wrote to memory of 580	1688	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe	30
PID 1688 wrote to memory of 580	1688	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe	30
PID 1688 wrote to memory of 580	1688	d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d843ed7797a1b6badb49e470fc1c3bf5_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\08AD.A42

Filesize
1KB

MD5
98d7eeecff2bf66f562526bdc0ce7a17

SHA1
b9cc92d2b9f5faa3d7de2e9ca5466dc16aed0229

SHA256
c4b94e836669810323a1d1decd061ea37007ab4c1573e69a27e5bba1344d69d2

SHA512
af2b8720a37db564d251a924c8f2360fed4835d931dd9e29c8a5a4ea8686eb7be710174fb232d9fce187752946687b001002f10c638436a9c5937ffdf5aa3d7f

Download Submit
C:\Users\Admin\AppData\Roaming\08AD.A42

Filesize
600B

MD5
f87e7b6aa442941a2c9f28680aed90fd

SHA1
49af62623f7fcdbdd24a0b2cab0c0e53250c84b4

SHA256
7a88e9534a748ee601b60a89a02267976fe1e4cab968e4dca288a2c8864172ba

SHA512
ac89c4dfd7c60afa287daba8600fafd304afe340bf5a1e97263ba79d9c47e2a9b70deca8c350af57a1cadbaca85eb5b5b4b1d908d96768e29582258bca81c96c

Download Submit
C:\Users\Admin\AppData\Roaming\08AD.A42

Filesize
996B

MD5
bc72124a80d448407770b43870564143

SHA1
dba3b8daab4c2c64343802bf677b727c66154690

SHA256
c44ab199d25d9b93bee34d85c55eee83a1143214140db4f536e35db5ac3e0119

SHA512
873d17a88253769c12d30c1a6f95fd74fdeda474a54470068f2fe3ce60dea763a3f40e6ba240b775f84f7b5e2a0f7f1833f9aecced6dbab38faa54a51791fb6e

Download Submit
memory/580-75-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/580-76-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1688-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1688-2-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1688-14-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1688-77-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1688-180-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2896-5-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2896-7-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads