cycbot | 1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418

General

Target

daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe
Size

187KB
MD5

daad9b133d139f509a2ef348da66c146
SHA1

1f8730c8bc7a0765e2f0983ae88f64838eb7fa84
SHA256

1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418
SHA512

a62c92899220125132b5805140d9f43af86e35537ef362e069bd8da592bc925a502e20c7b7d386cef09532667c7d39b1d785e293bdad39deeeba3be531cc62d2
SSDEEP

3072:umpgG33H1u5F79GNgPrnw+fg+UbH8eIA6EfI73VrarwObkeLpp+RuDN4o:mwHobkCbw+fAmdzLparwWLpgSGo

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2548-7-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2348-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2652-88-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2348-89-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2348-186-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2348-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2548-6-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2548-5-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2548-7-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2348-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2652-86-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2652-88-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2348-89-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2348-186-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2548	2348	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2548	2348	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2548	2348	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2548	2348	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2652	2348	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2652	2348	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2652	2348	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2652	2348	daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\daad9b133d139f509a2ef348da66c146_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2F44.910

Filesize
1KB

MD5
ad8fc199c4c7632d27dfc917194c00f9

SHA1
4ec3e7291861fb04f10cc1325841aa26ac77da65

SHA256
94c46919d4e6580135be766c77393138730ca6838e859e4a8c1d5235f8b19ea9

SHA512
bff77c154e6950af4bd5511b198736b287e6acdd3087277af8add60736ba3ffa7179b38fcc8144c657a4c15503f5afebe8eabd8672335c874bdf8f7ccdf23485

Download Submit
C:\Users\Admin\AppData\Roaming\2F44.910

Filesize
600B

MD5
fb9af95cf1deeee3130a4c582dcc9b54

SHA1
b973d98b01bcf5d9db7511f3f1062e45113afda0

SHA256
f3e9e26a45a2d77ee5545a0d2521cde92c941732ff2f3cf1aa71b72d22d1cd91

SHA512
365954a6ac88af67576811c9fc0a5b388455a6cc75cac0f58e68f961f9e6d1808640c3fe55d2d8d2649a068044ea753b1f5ac5dad171d3d10efb28add2d15c31

Download Submit
C:\Users\Admin\AppData\Roaming\2F44.910

Filesize
996B

MD5
170bcbec61fe23f2c964ef8131f4f3ff

SHA1
e05c2a8c27237717029118a87b9f5fef319867ac

SHA256
e0ae56d529e8b35869d22a6920a84874b31e46507e2f9b792fcc7a47f9ea2c08

SHA512
bb0d2f74693b844838deb3602ac88727df4e3311621fb250ce61c71594a49ade5b35b94812015e149b074290fb95ddce366dbefe906254442ce0da2236a8606d

Download Submit
memory/2348-89-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2348-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2348-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2348-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2348-186-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2548-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2548-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2548-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2652-86-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2652-88-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads