cycbot | 09a79b2d84ce8c6c9ed98ae25dcbfdd8b69edaa2d07e1418a452b622399468de

General

Target

e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe
Size

179KB
MD5

e32d431c7e28cf4392cabf071876c830
SHA1

5a7e765a22c1b17a367605629c0585a94f4d42c1
SHA256

09a79b2d84ce8c6c9ed98ae25dcbfdd8b69edaa2d07e1418a452b622399468de
SHA512

0068c9ba1f3ec2fa02401b2f309358a0a001a4019471f13b434a5ac04de2893c482ba911d44b6d73815f879c5d10c93ebad8f1dab94336a3f34a98f06356b382
SSDEEP

3072:Qvpp4K6gHfihdTAMqciIrCRSSINuE4uVmqfWVpkmvFbYdupGb3HSbtLnlr+6Z6nZ:yH46HfihdTAMsIrCvhE4uEqEvFbYdefX

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2488-7-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2488-8-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2384-16-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2384-77-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2144-81-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2384-192-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2488-7-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2488-8-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2384-16-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2384-77-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-80-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2144-81-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2384-192-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2488	2384	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2488	2384	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2488	2384	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2488	2384	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2144	2384	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2144	2384	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2144	2384	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2144	2384	e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e32d431c7e28cf4392cabf071876c830_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\31D6.496

Filesize
600B

MD5
a5845490f1359337e1dc591900f56c10

SHA1
82c96c33a935aa78df1536a3a96517de7bad0d1e

SHA256
a19b54cc66d3649781bf2c6cfa53ca0483f5db9ed8ae22f95856cb284a670769

SHA512
6f1e0af57f78d1d64e0826dbd58ebde40728b4796535a994a20d04900a5eba8451b4eee10b8a0924a153b9c71b650d90dd00b3e9ffc6aaf1c9eb641182be107d

Download Submit
C:\Users\Admin\AppData\Roaming\31D6.496

Filesize
1KB

MD5
32719697657206c7a9d8b9e82bfc11f5

SHA1
0d609489d784e3696dfd93f5fc08bbbcc585f2c7

SHA256
48642441539500840f89ac78bb64dc615f43703660495ac51e4e108b3413cac3

SHA512
d8098ce6964925b155c739ab55dc69688dbc32dd19d1b80fb8ddc3c7cf3e95361f8c4706b71550fd4d49fbb4745a2a63832c6dd7f30abc82ec83861f64f18545

Download Submit
memory/2144-80-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2144-81-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2384-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2384-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2384-16-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2384-77-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2384-192-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2488-5-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2488-7-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2488-8-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads