cycbot | be4e523f9d9dbace3b24150a555e0a8ee6ae087c8c61aea063294a89c67e6e90

General

Target

e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe
Size

167KB
MD5

e12bffa51c4d53eb39dd4c3224b7ed51
SHA1

f8db74d1da5533dab5480860fe72f32810c78849
SHA256

be4e523f9d9dbace3b24150a555e0a8ee6ae087c8c61aea063294a89c67e6e90
SHA512

7a223176aa1c088903b98c500f406c5527edd02e6b5aedf484cfcd0412cc713db06dfefbe91b83271363cd8bb1e764852171eef4b5c92af3ca01ea69ebd42f82
SSDEEP

3072:wrWuwL6HhqOTAAz3MmteNwnBkiDMDLL4m+R00VmeRMafU+f+cNK41AVSBaPcF:wWL6HXRtZBkB+R0SEZ+ftNBvB

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/3000-12-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/1776-13-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/1776-73-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2248-76-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/1776-189-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1776-2-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/3000-12-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1776-13-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1776-73-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2248-75-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2248-76-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1776-189-0x0000000000400000-0x0000000000444000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 3000	1776	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe	30
PID 1776 wrote to memory of 3000	1776	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe	30
PID 1776 wrote to memory of 3000	1776	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe	30
PID 1776 wrote to memory of 3000	1776	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe	30
PID 1776 wrote to memory of 2248	1776	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe	33
PID 1776 wrote to memory of 2248	1776	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe	33
PID 1776 wrote to memory of 2248	1776	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe	33
PID 1776 wrote to memory of 2248	1776	e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e12bffa51c4d53eb39dd4c3224b7ed51_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C6C0.5D3

Filesize
1KB

MD5
bc10f02c86aad39d1b7f86783c72a95c

SHA1
14a3f075eecd6a1dac021db5803fd900c1400fb8

SHA256
5a93deef8ee2b58bd3ec300fb441d84f51fccffd3324aff4892b9a6695b4822b

SHA512
71f1b1c3ef9ce35e39cb916803d4f4d2d26b1165c0b969a149c219442ef5707e0f45cf82440daf87363deb3e78bdee82bafdecfa1f84d02bfe30e3cd312aae8a

Download Submit
C:\Users\Admin\AppData\Roaming\C6C0.5D3

Filesize
600B

MD5
46c2e493480097ffb60fcb21983e96a6

SHA1
728e986055b15398b1e40c60cb865bddd335549f

SHA256
1bbaa13c22f0f8cbf2700cc4605fe67e1507d1b57a61f29ef8f8adf434766c67

SHA512
a333ea2af41c7a9dce2127f25a29eeb0590edbca35c4651b3f7bd4277909661aa9c80a8ccbcde5dd7d86448777c2a0124f9661330348d99f7acda5be513d6f3d

Download Submit
memory/1776-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1776-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1776-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1776-73-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1776-189-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2248-75-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2248-76-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3000-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads