cycbot | 319edcd705e76c1ae09e9ef383a964a042c71d6cd859f6181ab7b16d678e4afe

General

Target

e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe
Size

176KB
MD5

e3f540d2c1bec03f3dacc75d0057b942
SHA1

ce65f2ba83a7d9d997566c60ff0f43fe8565d348
SHA256

319edcd705e76c1ae09e9ef383a964a042c71d6cd859f6181ab7b16d678e4afe
SHA512

b7c81f66d52be1a28049d8f7220453611cee326f6ccbf458b37aa0f1ca4f7b36fc4303d381aeb62ddb0623f0b45f6b779a4dc6b7380f843d1cb98a086d190baa
SSDEEP

3072:/CsNAKJx/U5Z5X81JAhMcQM3+2Kl9Vd/PwmJ35I7EFEes5iPMARCksh2c6JNB5oS:/DAQG5GJgMcvgl/Pwc36OpXR+hF6z7bX

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2412-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2128-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2128-16-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/1140-115-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2128-116-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2128-278-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\EADD6\\B0E53.exe"	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2412-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2128-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2128-16-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/1140-115-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2128-116-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2128-278-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2412	2128	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe	31
PID 2128 wrote to memory of 2412	2128	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe	31
PID 2128 wrote to memory of 2412	2128	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe	31
PID 2128 wrote to memory of 2412	2128	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe	31
PID 2128 wrote to memory of 1140	2128	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe	33
PID 2128 wrote to memory of 1140	2128	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe	33
PID 2128 wrote to memory of 1140	2128	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe	33
PID 2128 wrote to memory of 1140	2128	e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe startC:\Program Files (x86)\LP\536E\A95.exe%C:\Program Files (x86)\LP\536E
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412
- C:\Users\Admin\AppData\Local\Temp\e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e3f540d2c1bec03f3dacc75d0057b942_JaffaCakes118.exe startC:\Program Files (x86)\D6146\lvvm.exe%C:\Program Files (x86)\D6146
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EADD6\6146.ADD

Filesize
996B

MD5
b773172f47ca696bfd84c4a92d6e3bb9

SHA1
5defc96ad73f693b5a6e8de6d1e044adc863b432

SHA256
745837647c0c71144ed6fac39f8da14fc1b0109cdf842dbeda869333e599de9f

SHA512
fd69eed2c1c9a73ec3f946e571dbf09dbc2f278af73f65dc7d63589f5c2447a6e3d42f18a020b2141cc95c02b258ecacf4f7cc9d72877a8b779e39999d18fe6d

Download Submit
C:\Users\Admin\AppData\Roaming\EADD6\6146.ADD

Filesize
600B

MD5
2c8eb31cbad7e6001da0149f9bc28f32

SHA1
5a76e7e4dda6517aad5747dd7a0d0a97cdd6230c

SHA256
ab8a0063e9d40d4d09d10195786e3320bebd0fe36e834d9c10ac30c455cdd8ea

SHA512
c053452b3fa538f4475d5f89647fab8acd6971e4213a2b1bc2c0a279635708d2d7fb04c6b0fd52b0c02346c7c0c1cc837566b1f77286e2276b1a0b0a7904755f

Download Submit
C:\Users\Admin\AppData\Roaming\EADD6\6146.ADD

Filesize
1KB

MD5
c3ac1041affc73b3fe5bd2d405a501cf

SHA1
3dd506d46f3bcdbda427a294371f4cfb5c2e051a

SHA256
16aefda278e832eba6ec9f66072fb4a1b2f53f4e2a755328b45bbe4c6d1bde32

SHA512
db1ddf665a5b2ed202d849337eae8db131575e671c7977dc6f0037aa21f632b8e638589d4f3686162be44f1e8b0f0040d0e362c41fb172f15f6ccbc502d07866

Download Submit
memory/1140-115-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1140-113-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2128-116-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2128-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2128-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2128-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2128-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2128-278-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2412-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2412-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads