cycbot | 4d49f015bd331bf7f5f75b80579179d6185ad9e44855d0db7e5113ff932a50ad

General

Target

db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe
Size

158KB
MD5

db7241a0d65a834adc9701d1878d2653
SHA1

4510482471b4f1a69635fdddec525d4e907212c4
SHA256

4d49f015bd331bf7f5f75b80579179d6185ad9e44855d0db7e5113ff932a50ad
SHA512

c02d4d667292c2d0f6f8f6f149603d8dc5210a6a8460b1d30f472bb6f91af5cdad1a57364befd3a68460e69fb47ae0a3bc5e535e706cc94997f304e53402ba8f
SSDEEP

3072:+nOyU5aSxU9SCdHkW+5aTFl9GF8Y3QyxoPbV5Eq:EOyU5uSCWWSapl9Vu94H

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2528-9-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1580-20-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1580-83-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/936-87-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1580-185-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1580-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2528-7-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2528-9-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1580-20-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1580-83-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/936-85-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/936-86-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/936-87-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1580-185-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2528	1580	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe	28
PID 1580 wrote to memory of 2528	1580	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe	28
PID 1580 wrote to memory of 2528	1580	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe	28
PID 1580 wrote to memory of 2528	1580	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe	28
PID 1580 wrote to memory of 936	1580	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe	30
PID 1580 wrote to memory of 936	1580	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe	30
PID 1580 wrote to memory of 936	1580	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe	30
PID 1580 wrote to memory of 936	1580	db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\db7241a0d65a834adc9701d1878d2653_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A0F6.C83

Filesize
597B

MD5
91dc84ba0f03409b8d2a1962ef76846a

SHA1
e2d095f36637e6f850778b838be7a5ba8b176123

SHA256
829738e10955f848a4541051bb2ef2bba8b1222a4db696ba040421661f25104f

SHA512
532f21c313091c62271d706a796bf757d3dc1908cd9a404ff5f836dc82da4c4c10484d02a37e9b2eb2ac7c9b1d01b344f8bf694fb9304b84a8cc30cacc76dc52

Download Submit
C:\Users\Admin\AppData\Roaming\A0F6.C83

Filesize
1KB

MD5
ced0c3ba96bcad4d4a1b06e644b0fb75

SHA1
bd6d698ba032bcd9e20a8bb4381ba7fc2be63414

SHA256
0d8a6889573bf90ccd7471507e985b10cc570420bbd4e3111e0d42aef125632f

SHA512
f8b25569e02339582b2ab0697568391108e771f238c75eedd11771daed7aba28746121a9ea860194c4d49f9b5041289bdd146ed21338bb92e545c6e00b0f0841

Download Submit
C:\Users\Admin\AppData\Roaming\A0F6.C83

Filesize
897B

MD5
bc62f5d20fd95c905c9d25aed1ca750e

SHA1
466b0d1a8528ff2a1d6481facbc3bdbe0a5f5013

SHA256
76b582db2a0913ad48752e26c132e54873057ebd9f57a068426a9245eaa3cd7e

SHA512
4941c309fb546e69e88401a1c7bd539edbc99de13c41747ead900d871b8436e8fa5c4c53dde5a4fff9f7e3d381c9b231c6c266078b830654e1913a57381d48ba

Download Submit
C:\Users\Admin\AppData\Roaming\A0F6.C83

Filesize
1KB

MD5
95d401a876baa8164a1f9d5fd19cdf38

SHA1
10b0c78b19d1e6b92dd76648faac65d2ad24ee14

SHA256
3f0a901e1a49d93c5b93e8b92207f01a64acec5e3e11dba6955ee52afd3d58ac

SHA512
64ba53a34e8f2e8643c168ccbe0dffddcd846ce7928b5c2bae2aa11599ed8ac6cf037ce2e0e399576b60b6ad2c5d7caf61b05969feab912afab1083594562a58

Download Submit
memory/936-86-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/936-85-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/936-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1580-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1580-83-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1580-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1580-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1580-185-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2528-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2528-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads