cycbot | 3a25ace61427f636b1ae70700031cb484af84555f7b93d11a7cbb102586a2f0c

General

Target

e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe
Size

202KB
MD5

e4b45a43e41484cff1f00bb8534500bd
SHA1

a83d58b6b21b568b1ca766508015c82705d1a496
SHA256

3a25ace61427f636b1ae70700031cb484af84555f7b93d11a7cbb102586a2f0c
SHA512

7a4d56695ebe04e5618b14b31dd9f4befaeabc885dbb940385abc79ab1d4e321c66a0fc5c9ffe590a168618c6261035342fd5f948f8026a70479d18f79794d03
SSDEEP

6144:qdaWg52l/KfoGZuyrIhg4/a4BUiqu/If:qEWgkykVajm/If

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2404-5-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2376-13-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2748-82-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2748-83-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2376-84-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2376-183-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-1-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2404-5-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2376-13-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2748-82-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2748-83-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2376-84-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2376-183-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2404	2376	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2404	2376	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2404	2376	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2404	2376	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2748	2376	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2748	2376	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2748	2376	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2748	2376	e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e4b45a43e41484cff1f00bb8534500bd_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0E88.D6F

Filesize
300B

MD5
5ff251d74b68d74d8a428f1e98073a75

SHA1
7b6b412751f106e7c7429f995a850cb4036e1f6b

SHA256
8bc2f3a1960f7fa240856c6736fb9c5f48abb7911585208fc77c414cda435451

SHA512
f2214ba9f35f4868a8556ba41883ddfbf2c31cbeb695300f987ad30b5ba530cc082d29b945c731055ea58daef51f5fd9c867ab08366d9a50be7860e8ee7524e7

Download Submit
C:\Users\Admin\AppData\Roaming\0E88.D6F

Filesize
1KB

MD5
493f9a2593a4ffe3e911b638fd644e34

SHA1
e0e9777e22a6944ec7236ffe5e27799a65db37ff

SHA256
a535afdb9557cf87f3c8ff8a726a4fa0cd8f09db5b580febb20d4393187feae6

SHA512
c251652dec6b9e2da78f392d0322c500a2bf120d452c988e7128fed7664761b4a0231fbb038f3f1d5f2a5ea48b6232a32f15aefb240e651d916c85fa81fe8a4f

Download Submit
C:\Users\Admin\AppData\Roaming\0E88.D6F

Filesize
600B

MD5
83ced00625970932bafd0b14336032dc

SHA1
2b8699e282a2bf63452b84c40ac6af8aebad160c

SHA256
66b27ef9e4ac63413180674ab39b132f02b66a3d0e3fc51b15c5e4061ddf9303

SHA512
f2e500cb18b15f27f5fc04911bd582fd85cd0e9d1ca68632c1089550c30da6eaf880717e628cec6bd8422b8d5d5da51d89716900311b09b73e48b9b701be3563

Download Submit
C:\Users\Admin\AppData\Roaming\0E88.D6F

Filesize
996B

MD5
93e60569de86691afe6a96c62f602433

SHA1
2fb72bb8fec784629bc759919a4599ee241abfa6

SHA256
a5fa4073fae19961b48110c68c1a1e3f86c735c02431e87844314abc0551df23

SHA512
cc798e6e452c7034e8285368ac79697a93aa0efea7cacb215c3254a9bf7b35e5530bdc627061131df33e4edd2c320d33295a3cebb7d13cf0386791fcd0c0c37f

Download Submit
memory/2376-84-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2376-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2376-13-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2376-183-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2404-79-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2404-5-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2748-81-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2748-82-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2748-83-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads