cycbot | 7215ca9d1a38ffa31663e43d869958a9cda47e5b4f76b1ae8e010152e5da1924

General

Target

e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe
Size

168KB
MD5

e4e2d88e8c7740581f300995189d0393
SHA1

13a88b3a57190a10838aa92aae1b649443e9549b
SHA256

7215ca9d1a38ffa31663e43d869958a9cda47e5b4f76b1ae8e010152e5da1924
SHA512

ca838530a6ebe2e983bc09e1f8e66738306d2bf17124b99e8c23a660cb404d2072611350a4690caa33124d6d0a9665ad97f265d8e76357768eadbb918a8a62b9
SSDEEP

3072:S5Wt/iXE2F7S0nmJqPTsEof4R88yz7FzxTiiisHs2fKnqIBYaFIDe3i:SUt/uPdqJqPYEc4WD7FzEbYaFIDeS

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1788-8-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1788-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2504-16-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2504-84-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/636-88-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2504-162-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2504-198-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1788-5-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1788-8-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1788-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2504-16-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2504-84-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/636-86-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/636-88-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2504-162-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2504-198-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1788	2504	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe	30
PID 2504 wrote to memory of 1788	2504	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe	30
PID 2504 wrote to memory of 1788	2504	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe	30
PID 2504 wrote to memory of 1788	2504	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe	30
PID 2504 wrote to memory of 636	2504	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe	32
PID 2504 wrote to memory of 636	2504	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe	32
PID 2504 wrote to memory of 636	2504	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe	32
PID 2504 wrote to memory of 636	2504	e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e4e2d88e8c7740581f300995189d0393_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\53E5.6F7

Filesize
600B

MD5
52035183ebcefd1b773950efd38b31c9

SHA1
a3537f6c757a3f31047d7f2c85c580d6df16e9e3

SHA256
b1bb77634d019d4c4e0844784bae8a8a94a1b4c581d7217b2b39b74757e89409

SHA512
33e6b2ef423791dbe4b0e1117f3171294523463df9de84d9e233890bf09ab4b40d1467a4bca716b834164fc84d7b29ee85aeaeca09ec4fbc4e2c278301eabd57

Download Submit
C:\Users\Admin\AppData\Roaming\53E5.6F7

Filesize
1KB

MD5
13662b175b2a1f6a7c0587f5d445087f

SHA1
e4f30099d605b06b543a9898819b3a50e0c31755

SHA256
925bfae647f405a8fb2affa3b929bac01be36295f8049527b4536dc4d65f5d8a

SHA512
fad9310d8e44d26092ebdc906c8a9b4c67f29986c30501cbcbb16dcefaea809be66e896ecc1f8f0eccc077d493c4dfbcc7732afb2569e980243791ddcf415e14

Download Submit
C:\Users\Admin\AppData\Roaming\53E5.6F7

Filesize
996B

MD5
eded7fc454696d1559ab9e21c2ba66b5

SHA1
c7bc3bdf1cf679e4154c327bfd246c903a9bf69e

SHA256
5b20a40992c5c3e3489e91dc20d824794ecc7649b981a7d3f2c6c64296c76c06

SHA512
6f52f858fd265d94e706d61c1abd557e416d16a27ec3224446e75b4f1447fd32138a07698bd25531e5c1fe366fef6b3dc942919857b6d6360ac646cff7dec1bd

Download Submit
memory/636-88-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/636-86-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1788-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1788-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1788-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2504-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2504-84-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2504-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2504-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2504-162-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2504-198-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads