cycbot | b1e02a41598f99626f71545601f5b8768dec7194af5014cfc08c3df815612833

General

Target

e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe
Size

157KB
MD5

e7cf74bc195962039c4e9985c09e19ae
SHA1

3493ddd8758710f13da7e381a2ca07650d143c7d
SHA256

b1e02a41598f99626f71545601f5b8768dec7194af5014cfc08c3df815612833
SHA512

c7cd868eb9293313017fce4b60035feccf7e5e5b8a72e618e1d3a49a2ee661c076661a581c8a165706fd49f2ad266a255590235b775ce140028ca6ac409b81c8
SSDEEP

3072:e2Y22r5Ml9X8dvEW2w5t3nKJsprZhuo01EDWHZ54TdS7/l7SS7StqXNdmz/:MVril9X8dvt2C3Br01lHb4RSLpreKM/

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2876-9-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2496-20-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1320-89-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1320-90-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2496-91-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2496-191-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2496-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2876-7-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2876-9-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2496-20-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1320-89-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1320-90-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2496-91-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2496-191-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2876	2496	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2876	2496	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2876	2496	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2876	2496	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe	30
PID 2496 wrote to memory of 1320	2496	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe	32
PID 2496 wrote to memory of 1320	2496	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe	32
PID 2496 wrote to memory of 1320	2496	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe	32
PID 2496 wrote to memory of 1320	2496	e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- C:\Users\Admin\AppData\Local\Temp\e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e7cf74bc195962039c4e9985c09e19ae_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BE29.090

Filesize
597B

MD5
f2f00bd827d25ceeba058af0c4424d96

SHA1
83a17093b815d2dbd5971b2ef1c6822b7337fff3

SHA256
8407d790f39222e12edf947b4a7b11cc182638290b0a49afe640f78f307593df

SHA512
67fb39fcc1c713454db5dedc59d6cfbb70c4d9a3d6ce99bc632908c2949695e864c3632e7aac83917e8e0bd8ddf0c9160b9a6b1ac46b4fca5965a181d9e3ca54

Download Submit
C:\Users\Admin\AppData\Roaming\BE29.090

Filesize
1KB

MD5
c18ed18404e1a0889c42cbb60fd85dc9

SHA1
e683967152af2328db2f7ded00be3a91cdf1e1ea

SHA256
089b04fede134cfe402686c2dad86bdc99b4deacee2d0e2be7285082a2ea0841

SHA512
7df2587bc8a6841a9f80e72fd1f5cbddead56b1f7625f12390a5ec5fa3e1cf61485559b5303be157367dc79135a6dbd4e339b50720c10eb9f1467417baf66115

Download Submit
C:\Users\Admin\AppData\Roaming\BE29.090

Filesize
897B

MD5
7336dbf26a56d08699eeaaa6de7e0e8f

SHA1
0d1c782ee5b54b738b20b8173aa11161fdac8f7d

SHA256
dc99ae4ea22570e014a0592b6d9e74595614c480a8b64c86134f50a3353b7bce

SHA512
3ca5ebea3a314e7ff07f71cbdfda170f0ced9d40294ffdde63084f51d094e02be6e974f16bd6276595fba556d0934a48bde74ad63add62ebc7080e3cfa1102ce

Download Submit
C:\Users\Admin\AppData\Roaming\BE29.090

Filesize
1KB

MD5
755f9d6c4361c4370f4fe624890324f8

SHA1
30516ef755d0d8d3eb23bfe665cfd9fa353ba8e8

SHA256
a872eeeba70535072eddff47b653b1ecb959a96e5e7460989ca51298dafd1553

SHA512
8ce909b21d7a09920ed808045e4e6d161cec97d2eb05bd820978bf552bbf8a9d1ce1c0af2cf0fecf5832f7a00969ee70c7eddeab0fae9d07809320e13635b838

Download Submit
memory/1320-90-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1320-89-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1320-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-91-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2876-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2876-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads