cycbot | 6040852a791234b018bccf9276763e3ba3db726e98156b4b2a318a10aed74f11

General

Target

ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe
Size

168KB
MD5

ddfb85764d24d7a35245c9ef639cc366
SHA1

5141c6ed42f0fdd693876577ba49f0856c484d08
SHA256

6040852a791234b018bccf9276763e3ba3db726e98156b4b2a318a10aed74f11
SHA512

67c89719b92f8b2c2c191ac612a3415613a26e22f92b07e980a4e8cefa6accf9d5067c3e7b13a340806ffa2264f5586d07c5049f3b457227470a82e29945063d
SSDEEP

3072:rD9aoju4GJnPRsWGTuTO8D7ZTBvYZgnpHphHkRaJB1P+76h8y7hm5D1muwGn/aDm:H9aqG5psjTuTFqZgnBcAyy7e1b3e3C3t

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3228-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/5116-15-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/5116-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/5116-74-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/620-79-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/5116-141-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/5116-180-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\ADA5C\\C41F9.exe"	ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5116-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3228-12-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3228-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/5116-15-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/5116-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/5116-74-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/620-77-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/620-79-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/5116-141-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/5116-180-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 3228	5116	ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe	82
PID 5116 wrote to memory of 3228	5116	ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe	82
PID 5116 wrote to memory of 3228	5116	ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe	82
PID 5116 wrote to memory of 620	5116	ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe	88
PID 5116 wrote to memory of 620	5116	ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe	88
PID 5116 wrote to memory of 620	5116	ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe startC:\Program Files (x86)\LP\F9DA\59B.exe%C:\Program Files (x86)\LP\F9DA
  2⤵
  PID:3228
- C:\Users\Admin\AppData\Local\Temp\ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ddfb85764d24d7a35245c9ef639cc366_JaffaCakes118.exe startC:\Program Files (x86)\5CFB1\lvvm.exe%C:\Program Files (x86)\5CFB1
  2⤵
  PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ADA5C\CFB1.DA5

Filesize
1KB

MD5
442793e79575e60de8fc3dc921d67aec

SHA1
f683f1659c67070f97adfaf796e4527d8a58dc14

SHA256
a7420c7a1b74ac8aeac9749e6a8de2b6446fe387d80cae775423a8ba10d3e34e

SHA512
e26d2210aaaacf01a7d97937c0180f84c0a6c8c2cb2c16c983d125228f10f8f761b00c687d2ba124754664214849cc0501dd9f6d940c5f39be966cd606532924

Download Submit
C:\Users\Admin\AppData\Roaming\ADA5C\CFB1.DA5

Filesize
600B

MD5
30b0710794af13c8a782a8536d1ffbdc

SHA1
72a7a5b2531d8d0e0e1e6cbd764828a9d9823f3c

SHA256
eab7b29c5308580fedd4b3ca84f44366356adb074dcdad454fd00c8836f569ec

SHA512
6c5406e5d1e03b49c0be4ed6528235dd8fed090986f0d30cdaedfc03376afd21517239a1a1576fc5e29b9d4eea52211346bf3f97fa02991936e35aba848a3312

Download Submit
C:\Users\Admin\AppData\Roaming\ADA5C\CFB1.DA5

Filesize
996B

MD5
143836075853251054b73db2be1d2d33

SHA1
0e9220132575de4b47e28f5553d2c55ab6f5daf6

SHA256
ae55550ad2c6916d7fbe08b11f5dac15da885b6e5c7ac6e23f23a6110018ad7f

SHA512
83757bfc7138087462db812094480b1effd8c5f815b4b2c0fe8c69d6b5f972d7d4d14fd4d0bebc7293ef672f8566b99bc11982e330368815faefa2918cd49ffa

Download Submit
memory/620-77-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/620-76-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/620-79-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3228-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3228-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5116-15-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/5116-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5116-74-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5116-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/5116-141-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5116-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5116-180-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads