cycbot | b8e6e8fbc3bf968f4a99d54d75dd42f4f3b2fe51036b4a21930e72e65a80e2c9

General

Target

dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe
Size

183KB
MD5

dbfa5853966f50bccf28fa113378c202
SHA1

8270a1a4338eb52d929155088e02367b996a4468
SHA256

b8e6e8fbc3bf968f4a99d54d75dd42f4f3b2fe51036b4a21930e72e65a80e2c9
SHA512

0d0c7c09fa6c5dc2b6000bc002bf0a92ecbe2339f503ccc246d807e5601d88abe1e854adcfd672a27d578d706c09b79b5b344fc0ef2716cc7bec91ae2d6bb1f5
SSDEEP

3072:JvB1j0oCB82+uJUxR4i+t//26cMO2pJsZRjckQZnH2vMFfb6Ln+42EaiuBhESui6:JvB1030fxRKtn2fMOGJmRIk07Ffbr4Ln

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2224-7-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2224-8-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2116-15-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2648-74-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2116-75-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2116-160-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2116-193-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2116-2-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2224-7-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2224-8-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2116-15-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2648-73-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2648-74-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2116-75-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2116-160-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2116-193-0x0000000000400000-0x0000000000466000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2224	2116	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2224	2116	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2224	2116	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2224	2116	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2648	2116	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe	33
PID 2116 wrote to memory of 2648	2116	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe	33
PID 2116 wrote to memory of 2648	2116	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe	33
PID 2116 wrote to memory of 2648	2116	dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\dbfa5853966f50bccf28fa113378c202_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\45EE.5BE

Filesize
1KB

MD5
04cf00217d69e71a0433079c54659aee

SHA1
907ca240c2c64c8e445124bbc378e19a5cab1263

SHA256
b4246b91cf7e56ad69c5d13d7d411d911a07e44aac0c4b6af82c5bb619cdbde7

SHA512
c5d2a577b69353d3056e1e3439868dff8047019b221ae7898c2b640d1b2ef6d64ac36a8f0a4f44bdc4d6f20cb47738b951c0525600bb26235029c02dcbc797c9

Download Submit
C:\Users\Admin\AppData\Roaming\45EE.5BE

Filesize
600B

MD5
fac7ca46a540b722b05c19fd37d1e340

SHA1
82d9213cfb18d703a1d0dd6f58a9d3a5fe946e3f

SHA256
90bc56ca91c6fec04854e85ae9cdbfaf457da8a71b5e2d18065aa8962d797320

SHA512
22ba15d5b6ad144cf2de62f6dc3e1a5c29b19ee21053e0dfb0b019b8fb6c26be3f8e081743237c0e2111973c457775cb9c7d0d9131a10bdae989a2c109316619

Download Submit
C:\Users\Admin\AppData\Roaming\45EE.5BE

Filesize
996B

MD5
88dd5add81d96385f1a610a0f4ada6fa

SHA1
c9be9b0cd996669c8b5b18990414fb25e2f56ec9

SHA256
9eabf773b38259bbff643f31b2d40245a5d173f027e28f6366c1964dcadbe7f8

SHA512
1379cd178ebea7940560b7c9e42be7258c4ae8b648cb42aaaf22818c271fb98a10b37f5d4a98138e91aa88f7b2ff148ca9b0607f35e5e4dd3361a0269a4a3d14

Download Submit
memory/2116-75-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2116-15-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2116-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2116-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2116-160-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2116-193-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2224-8-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2224-7-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2224-5-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2648-73-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2648-74-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads