cycbot | cd55b78b513ceac946fc91ca72dc6c5d0f0c05a5c80d0d0d0ffe006062f86da7

General

Target

e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe
Size

166KB
MD5

e4dc0f72cc5862a204738cb9c6429288
SHA1

1b1d5df55f676171259b57e8c334803143c3a08c
SHA256

cd55b78b513ceac946fc91ca72dc6c5d0f0c05a5c80d0d0d0ffe006062f86da7
SHA512

eef58327b97248baea2e04f28173f93be400af2e1e4173f468cb641106fe5046636ce593d42ad8c882b330cfd04401a80c5bdde13bf218df3f00c15ccd4e386e
SSDEEP

3072:1xAKwmQwtNH6n9jB5wkpPFzlC90/W7IlTk/1SRm4TKHXe6aluzzdXo9:1O6V6n9jLtFU/OASRvT6OafdXo9

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2464-16-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/388-17-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2024-86-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/388-87-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/388-159-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/388-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2464-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2464-16-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/388-17-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2024-86-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/388-87-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/388-159-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2464	388	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe	31
PID 388 wrote to memory of 2464	388	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe	31
PID 388 wrote to memory of 2464	388	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe	31
PID 388 wrote to memory of 2464	388	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe	31
PID 388 wrote to memory of 2024	388	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe	33
PID 388 wrote to memory of 2024	388	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe	33
PID 388 wrote to memory of 2024	388	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe	33
PID 388 wrote to memory of 2024	388	e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Local\Temp\e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e4dc0f72cc5862a204738cb9c6429288_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E426.6CC

Filesize
1KB

MD5
48d610d22c0a919f6850309067ee6a28

SHA1
be50341a9fbc55be10c76ead42b6047dd83d8a00

SHA256
5f447b0bc5bbe57c094b72e4ed33b3a14522e627ba6a46b1800c96ad12108073

SHA512
8871c90596508c936a343fcdff7d74a0caf3e7f0e624a831ce7b60fd00221682852249788369b5519e1613ef47a82e738d776bdec99503fbef013668f32c94be

Download Submit
C:\Users\Admin\AppData\Roaming\E426.6CC

Filesize
597B

MD5
eb180e79bb864182fa238b24373cabfa

SHA1
98851d0e0d7f9209e38508c1eb1a57d2921a34cb

SHA256
f3cc89c77e5801c1320a96cfb8c058edb16f5c8e0747c7bf6e92e09ceea5cbd3

SHA512
998a0f3dae5b7923385d344b91ad914dfb2a5343a98112a1cea89fc06c5957cc4897a45fa1f442f8d0f17f593c6997a970052773f2d34746f287a1e94cc2c5fc

Download Submit
C:\Users\Admin\AppData\Roaming\E426.6CC

Filesize
297B

MD5
7ea4aeafbbaec53371f39b0fc19845a0

SHA1
ebe2799b69b112f2e829891db980c07d16513297

SHA256
a7eb9436c82410af98161dd7df58c30b72ce64d134d18c053ac50c0ed76e9c2b

SHA512
b1ac95e8abd012ac70bb4ce6da17abcd5813a4a45c817301e6daaef8c0cf13869ce12e05d9299ef14d15597e4cdc2899a76c176b92320cb67e04a42ff7568dc5

Download Submit
C:\Users\Admin\AppData\Roaming\E426.6CC

Filesize
993B

MD5
8e5ca19dec39ce46ffe54fc4c6bd6678

SHA1
790e9d4b3fe705fd10c4d646db4b635e4a93571d

SHA256
3d9808e6b26703887d5a59cf3126b3f8e370616c6f303929f5f6623401159643

SHA512
809cad7a2044cdc4aa6bf3d177accba26ef76881afd4597567f42468778d5dc752ee850fa55341a9c7d32843f036ef229234507dd1db6ba31dcd0dfee0588553

Download Submit
memory/388-87-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/388-17-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/388-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/388-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/388-159-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2024-84-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2024-86-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2464-16-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2464-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads