cycbot | 747bd403b404279ad7981079bb1a8dee9e00aefa2e1f623341607d85c43638fd

General

Target

e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe
Size

189KB
MD5

e3d729008ed808f563b68f06cfb2c093
SHA1

f780bc199468766258ff509aa7adb1500912bc7b
SHA256

747bd403b404279ad7981079bb1a8dee9e00aefa2e1f623341607d85c43638fd
SHA512

720ba86a144028a39306ea1f1800d2d95f82e8273413ea27c8a57fd3f5794fed3469bee399359d7ec21f255445a65a39a76babf9053c8e79df33cc2ad2139560
SSDEEP

3072:BE6+FFjTnlUhu0DyQCKEDzvEJ5VPmYSq344mhmtW35EadFDuozOzL:ubB6jyQCK665UYSqIxmqE+FDuoIL

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2112-6-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/844-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/844-77-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2360-79-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/844-181-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/844-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2112-5-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2112-6-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/844-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/844-77-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2360-79-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/844-181-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2112	844	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe	31
PID 844 wrote to memory of 2112	844	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe	31
PID 844 wrote to memory of 2112	844	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe	31
PID 844 wrote to memory of 2112	844	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe	31
PID 844 wrote to memory of 2360	844	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe	33
PID 844 wrote to memory of 2360	844	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe	33
PID 844 wrote to memory of 2360	844	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe	33
PID 844 wrote to memory of 2360	844	e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e3d729008ed808f563b68f06cfb2c093_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C831.D53

Filesize
1KB

MD5
1805263825fb440a521a543978625b13

SHA1
543e3d7dab742ca829d4a51383aa5522aa161316

SHA256
c93a92a2c2fbdf88f2810c9e398ac9fdc1800128ace93799ce59b524f7f705fe

SHA512
5fb632c63fb00c0e0596a884e029fedb2237dd067dd4b19816bee20a6d8c7bc49ec8dbfa04c4c918a71c771b17a97bee50778e616b3fa16cae4b767c036ee096

Download Submit
C:\Users\Admin\AppData\Roaming\C831.D53

Filesize
600B

MD5
d91a0b9d038255f0e9f2f9b5c7483896

SHA1
a55378527d9b2eb633ec014819f91f76f5d85141

SHA256
3f488d8f7d843c8e87391b4abfded770ec014153dc6ccdda50e9c0979a4290e2

SHA512
85d38657225ef89a66feed9948a27e60276e1f0cc7e7679e3af1267eee5873e5dcfbfb8143e5818e9c53676bd4a485ed7c9fa8f236f3111799b8657b0d2c88b1

Download Submit
C:\Users\Admin\AppData\Roaming\C831.D53

Filesize
996B

MD5
881b3c630d256e9bb2ee1e279f398c1e

SHA1
97f6f111cc857b656d42c2f3b46dbf7e0efb49ca

SHA256
a495c91d046c5bdec1e44cbafb142b820fcc94cef14e48064fad37f8b6b2e0da

SHA512
0fc92f4d80343805335c7270c26242dd752bb058d3683121bddfea57208490f127606a6c2e6069253aeb176dddc7e9a35bfcf8eb7ce83038f42d9c12b4d360eb

Download Submit
memory/844-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/844-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/844-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/844-77-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/844-181-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2112-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2112-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2360-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads