cycbot | ee346dd69156098a2b3a4971fc78964b43158a194aaebb51d044083e9613b993

General

Target

ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe
Size

184KB
MD5

ddfa4f928766d6d3b9fecb5ff3a45933
SHA1

9c6310571d9433ebd6fd1632bedad1afb005197d
SHA256

ee346dd69156098a2b3a4971fc78964b43158a194aaebb51d044083e9613b993
SHA512

44967e29a88d3ccd33383a61350a009754f30824910e65335428e56baee54550233feb1d3b3fee4f00bca2835a19069df60b832869f41b7f4cada84b5b6e4ecc
SSDEEP

3072:skNc8iH98POwCqdPbA/aNLIOvfZfHWSGHwp/jlaSCdCrksQzWkO4FO2Ysi2B:lqZ9SCGFLI4gU/jlanXuIgv2B

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2780-9-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2780-8-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2076-14-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2076-72-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/536-77-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2076-187-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2076-1-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2780-9-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2780-8-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2076-14-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2076-72-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/536-77-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/536-75-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2076-187-0x0000000000400000-0x000000000048C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2780	2076	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2780	2076	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2780	2076	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2780	2076	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe	30
PID 2076 wrote to memory of 536	2076	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe	32
PID 2076 wrote to memory of 536	2076	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe	32
PID 2076 wrote to memory of 536	2076	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe	32
PID 2076 wrote to memory of 536	2076	ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ddfa4f928766d6d3b9fecb5ff3a45933_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D0B4.325

Filesize
1KB

MD5
156a15f14843b7410a6cbbe68d672c32

SHA1
9539d2ece94922dc976ae485f5c80c9066efbee5

SHA256
a0a322beb1584a041d865cee9bd5f5ccfc211324d5a2240e9de455a067252989

SHA512
1c3564bf3a208b368b39e3d0b0ef60ea8812417068406562c2d2b4dbd25a9a2c8c8f8befa76eb0786bb48a0b769f1bcd73e558350f8ae8b990ed2cdb38c701fc

Download Submit
C:\Users\Admin\AppData\Roaming\D0B4.325

Filesize
600B

MD5
ae4278c5ee6d4def8ccff5b1689ea720

SHA1
bb6bfdde2db360b3a09c5f289ac465fc20febccc

SHA256
9679a6e79f4816ca462830f9ed5c29b724a4e2a202f73aa88a489af34131c587

SHA512
fa5f2076310dedf2267c0cd6eee57cdc88438bbdd8117d87bf941fa612985cb02597ce852b4cfac81ab12bc938e7dbf918f102dd5e330112ee3ace3f68de81bb

Download Submit
C:\Users\Admin\AppData\Roaming\D0B4.325

Filesize
996B

MD5
4065a7c18994d8a10a84ae28b5c5f450

SHA1
27c680c33e2d119c87eef65b8d51392f8b47467a

SHA256
e3f8834baa0730ff99f993c6361d87a2c42f60ff29d8839a3b91f3342aaca294

SHA512
84540c36072bbd9f929073685e38f7863c42b85963908fcfd2d4a98c3bef01ed812b606c276fb7c008686fb590e57ba95f18b7c125d6ce782044a477e313b1a2

Download Submit
memory/536-74-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/536-77-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/536-75-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2076-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2076-14-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2076-72-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2076-187-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2780-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2780-8-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads