cycbot | 2c5ce95aeacb3e801b028f20d29e38cc37f743e9510277c96a7a9bd59e6e1135

General

Target

ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe
Size

175KB
MD5

ea3b9249a3ba39f80ce970035fd29b6e
SHA1

ce74a66ddbb12215633684c89b8f8953b162d6fe
SHA256

2c5ce95aeacb3e801b028f20d29e38cc37f743e9510277c96a7a9bd59e6e1135
SHA512

b8a3340e24eb7a686e510d9cb5734e86a4b11e27892bef1f5cd9c9db6dd75ef06fe5fcd360a8c5aac71762f5c32e83ebfda964acf48bba8c4af9bc534d08b558
SSDEEP

3072:08pm73ZaCPVzYDHn6eXy5n0GrY7ANMFfNnRgs/M4/m+iNVvzxmJrY+zuHbKJlUtV:V0ZeHS50GqfpRRU9+A6IK8t6Vb

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2316-18-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2316-17-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1876-19-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1876-84-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1452-88-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1876-192-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1876-2-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2316-18-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2316-17-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1876-19-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1876-84-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1452-86-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1452-88-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1876-192-0x0000000000400000-0x0000000000446000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2316	1876	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe	28
PID 1876 wrote to memory of 2316	1876	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe	28
PID 1876 wrote to memory of 2316	1876	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe	28
PID 1876 wrote to memory of 2316	1876	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe	28
PID 1876 wrote to memory of 1452	1876	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe	30
PID 1876 wrote to memory of 1452	1876	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe	30
PID 1876 wrote to memory of 1452	1876	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe	30
PID 1876 wrote to memory of 1452	1876	ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ea3b9249a3ba39f80ce970035fd29b6e_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DA47.7FE

Filesize
1KB

MD5
6f7e07f56623c7d1f2688de4b1574b40

SHA1
3b39a9037b4bf8407b4cc8a385ba7138c4fec75c

SHA256
1b75b8c9b31c30acc4526a583ae0366c1330eda9492f245c8f94c26092a171b2

SHA512
59cb88d3b7bdb181ea0107f165118226e795c9def4fa20eec5fc4974463a7c3808d2aed1f021ba61afac8e6182ec26d03fae12b75cac4dfbed3e51125778bdc8

Download Submit
C:\Users\Admin\AppData\Roaming\DA47.7FE

Filesize
897B

MD5
f06752ab7e4535543f31b6e49ac3dec6

SHA1
c0727289bd30e1c601ea7383a844fcdc5ba77b36

SHA256
43a638dc4f6b24ec9a9bca6aba8aa83dc310ed09d251f30121fd126492b0ee92

SHA512
b43750886f2fbda6d262c7523bab4af93eca9c969329dfa667426485ab113d1d218c35c577ec6eb046f7eebfa9b67ee42ab3656e71117b8ae72986f47abbc61c

Download Submit
C:\Users\Admin\AppData\Roaming\DA47.7FE

Filesize
1KB

MD5
7d16b7195eaf8b5332253a151af0202b

SHA1
96d5366e079d6e72f05b19ec89fcd6d630d0ee42

SHA256
027ae131a8cc0aa764711de8015310c046da2c9471e09666ebe66fec848f1e36

SHA512
fc50797cc5240729f09a95a732ab3d336c0b30267b6a3a32a017d53c0b72726a22123f40d4715ed831b1e6ba235fd9b4b7ae1bdf11a6f17d91d4931f4d14de92

Download Submit
memory/1452-86-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1452-88-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1876-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1876-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1876-19-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1876-84-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1876-192-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2316-18-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2316-17-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads