cycbot | b8beaa6691629e237109c4d4baca960540a6e39e1928ebed7fba88264220aafd

General

Target

e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe
Size

180KB
MD5

e7c92550be6e64999ae9e16218a25866
SHA1

eafaf59e4a8a460a28eb13920af8c0f3836d4a80
SHA256

b8beaa6691629e237109c4d4baca960540a6e39e1928ebed7fba88264220aafd
SHA512

2b0473c012f10c0aff8eb7329b01b08a024de1e7d3be95cd7084ea72beda21e44537640d7180baa704a84c8669f48e0b92621b6c2a3884ce8b223c0f92ec5f79
SSDEEP

3072:4egiUWo2EtNZeJLWkxhGfsKqV45EJK58KsTeaBpkUEsDgOSZU:3giUWCEtFhqsKC4eK56qaBTEssA

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2220-13-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/3916-14-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/3916-67-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/1060-71-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral2/memory/3916-183-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3916-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/2220-12-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/2220-13-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/3916-14-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/3916-67-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/1060-70-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/1060-69-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/1060-71-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral2/memory/3916-183-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2220	3916	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe	82
PID 3916 wrote to memory of 2220	3916	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe	82
PID 3916 wrote to memory of 2220	3916	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe	82
PID 3916 wrote to memory of 1060	3916	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe	83
PID 3916 wrote to memory of 1060	3916	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe	83
PID 3916 wrote to memory of 1060	3916	e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2220
- C:\Users\Admin\AppData\Local\Temp\e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e7c92550be6e64999ae9e16218a25866_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\87FC.BD9

Filesize
1KB

MD5
fa88e22367128abb6dfe198f9483085b

SHA1
575ff5481fb1aa69773671008d4ad7db8c5a3105

SHA256
c970a410d949a95ff99b776c07c02c1392d435cd293826f0718f94d7d74bc514

SHA512
513e33d3de4dc4f3af0ed9a8ed7ce8e48820b5742915dee1ef5b7442e6cac3221f3f567aafe7c5ae1ebf8e8a720ede584bfdaa568b2650b86c55c67c53dc60ab

Download Submit
C:\Users\Admin\AppData\Roaming\87FC.BD9

Filesize
600B

MD5
745f016ca2a2d69bdbd9b2f189c1c123

SHA1
eb59f08b2930a4c0ad63caf7f64b7bcf2701ca49

SHA256
65aa89616bd066aaae4c65b6d7475ef8a94a510f0ab6c366a36184d0fa047611

SHA512
09c1d178a941e02dc5819b0f2154308ef10f2a00392e1452169cb82f50f468037babcafcc43d2621e5a00f6b90663782f529c4dcd11462b176c0a658a50d0667

Download Submit
C:\Users\Admin\AppData\Roaming\87FC.BD9

Filesize
996B

MD5
d2152e42c089cd887507e853e248b613

SHA1
8b318c203f2cb7e7501078ded789556cf78d97d7

SHA256
9f846f693c02ff9511e468973f9c20778838014480074c55f5452072d13c2d7b

SHA512
19b131288af7605aca12a5117c30a6d191c28c3ff44ab658a8c5e3dadd96051ded8e6ef7d8c5c7d4d534e3ac345132f5192d52c706a13b0ad7eb6d6bb56d5d8c

Download Submit
memory/1060-70-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1060-71-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1060-69-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2220-13-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2220-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3916-67-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3916-14-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3916-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3916-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3916-183-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads