cycbot | 37f3cdb5d0221a875a5f151e6f01c273b3e225d8886cad481c1d054a9680b924

General

Target

e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe
Size

165KB
MD5

e53d5f6a8efc6e31d4f56b9d8841275f
SHA1

4cfe2dbd02182c160199ec84e5d6555102b8f246
SHA256

37f3cdb5d0221a875a5f151e6f01c273b3e225d8886cad481c1d054a9680b924
SHA512

db951769e3e135cc3b2aa661dd6cbe693ddffb691faa3fc63826782a79d5fcd4eb7a505260e26231205f03d90e3d6941c039fb34d6d9fdca89c66d920127a9b4
SSDEEP

3072:tXRVUWm/NO0z6Qm35ed/hc9rzuhGbpObz4BnKyD16VC5ina6DhXd6G2:tXvANWP8GwXiX6V

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2724-14-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/3212-15-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/3212-16-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/4712-133-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/3212-134-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/3212-312-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\784D7\\F0D14.exe"	e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3212-2-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/2724-13-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/2724-14-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3212-15-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3212-16-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4712-133-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3212-134-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3212-312-0x0000000000400000-0x0000000000490000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2724	3212	e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe	82
PID 3212 wrote to memory of 2724	3212	e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe	82
PID 3212 wrote to memory of 2724	3212	e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe	82
PID 3212 wrote to memory of 4712	3212	e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe	88
PID 3212 wrote to memory of 4712	3212	e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe	88
PID 3212 wrote to memory of 4712	3212	e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe startC:\Program Files (x86)\LP\14E7\E87.exe%C:\Program Files (x86)\LP\14E7
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e53d5f6a8efc6e31d4f56b9d8841275f_JaffaCakes118.exe startC:\Program Files (x86)\D74C1\lvvm.exe%C:\Program Files (x86)\D74C1
  2⤵
  PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\784D7\74C1.84D

Filesize
996B

MD5
f83262d9268cb5585212cf52ff0e79bf

SHA1
eab54072fa392bb177a6f894bfbe152fb4f3dee3

SHA256
61b4399374f96491b8398d70e594fa354f6bc68c97542be52327bbef9392e319

SHA512
f1c42a7c9ac927f56592a8fe1bc25f22d92e8d02da523b4d9f2752948ce499eafb2168aab04bd34095828381d3394d6da781cf287f580cb184695ac129ededf6

Download Submit
C:\Users\Admin\AppData\Roaming\784D7\74C1.84D

Filesize
1KB

MD5
c4b28a12891d0519329397c808f42b96

SHA1
be37ffb6c7cce41991c13d9a5ee6f4e8775eb539

SHA256
10f705725d510427e31626a2e68c92456df37a2826cc04183dde0d648cb329af

SHA512
5e1e66c0186c1ca8bf771a1f8c8cd42384ca4aaf7264bd4dfba9cef14047cf3e03f72d53d7f36e097adb88276631da77493f2a40a69c2a2e2e9b70f32e3029b5

Download Submit
C:\Users\Admin\AppData\Roaming\784D7\74C1.84D

Filesize
600B

MD5
f9ac74fe103d3e5fad184dceeddf017e

SHA1
ba36f71ee7494f928208c4de617007e69b898f7e

SHA256
4ca8e7ca87d24e7cc35b04bcdd5f0b68da5e98ab5c26152b22acb2062c285274

SHA512
faff9bc8f244fe5d76f08a4e4220801c1ab824cfa70d4a4f929195a6c5ab7c79bd4b30c8a911cd7bf7a8c0c7373a0b37528afb5e55300794a371c6415ee863f5

Download Submit
memory/2724-12-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2724-13-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2724-14-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3212-15-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3212-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3212-134-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3212-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3212-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3212-312-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4712-133-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads