cycbot | 2ea5bdd2ddf67845d4a5e166494992521bbc59c6c14aa58b435c4b9f9f2c1c42

General

Target

ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe
Size

154KB
MD5

ec037ca59697ceaad75e779ef25ba441
SHA1

985d46f300cd57e366570e68d2f46084b312f534
SHA256

2ea5bdd2ddf67845d4a5e166494992521bbc59c6c14aa58b435c4b9f9f2c1c42
SHA512

0c9b91d62c58df90cbfe0769624494dc2725f15041f74c5068dfea9f4b55db09d4ccbc6679326dcdc384cd93e1516b9363db8f3208eeedc6230ccaa16dc43714
SSDEEP

3072:m+XC2wnwhpeovchz12YFaqFxWQIM1GL88VX0eSbwcvYPgLQENSlqUOXzPBw:dwnMvchh2MaqFxVIMkQ89QAKQISUjZw

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2704-5-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2704-6-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2408-14-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2600-75-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2408-76-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2408-173-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2408-1-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2704-5-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2704-4-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2704-6-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2408-14-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2600-74-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2600-75-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2408-76-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2408-173-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2704	2408	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2704	2408	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2704	2408	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2704	2408	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2600	2408	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe	32
PID 2408 wrote to memory of 2600	2408	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe	32
PID 2408 wrote to memory of 2600	2408	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe	32
PID 2408 wrote to memory of 2600	2408	ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ec037ca59697ceaad75e779ef25ba441_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D0F6.C33

Filesize
1KB

MD5
6640c4119999ae397512017f2dc0d416

SHA1
9944c58b3894c8c724e7894ec48e49c6efc58974

SHA256
7cf180fd9788d1168a662c9072c753352ce0dc81be8d20252ef8e1ef2eee904b

SHA512
a88d9dd1d0a0620330d18aa5f24ad0c071e532c273ab20b572ff9f0a879526e16d67ac89c543352c795138f7663cea75e02ef248b17d6ed4a5ba7b531ae0aa0f

Download Submit
C:\Users\Admin\AppData\Roaming\D0F6.C33

Filesize
600B

MD5
6f5a76e3d4163e2dd65416c0784b7d0a

SHA1
5ad0aecb1b32d0e1c8157906e5637973c6a02a7c

SHA256
719c0c7d7ed09e59dfd5f8bdc7061dc66813c8c8e0f11dcece20a621fcae3866

SHA512
4e5dc3cd8d156400bf573d5e0b05a92eee16726809dd3d6fb9e60a1f99b29d456ef7fa2b7e5ad5bb1c819d219d2e93109c4eb541e8c7e3933f0a47edd7c9014e

Download Submit
C:\Users\Admin\AppData\Roaming\D0F6.C33

Filesize
996B

MD5
cc68af4acb3d8d0ad8bb7b388f611fd3

SHA1
b0af57149485e571d2984e02c9f5d7ed3fbf5057

SHA256
7123e161ebe603a2c8e36c7e2b1cb55e7e8548ed5fe74708cb1587f85b70fe5d

SHA512
f0475b6d5f4bac4be58263291cfbb1485d0e3fa26ae0b53df55fe3fa2fea5c33cbb01aa58bb05deb120a16d52d3cee38175abe7f1c5bd59a79c607b8b444f983

Download Submit
memory/2408-76-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2408-173-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2408-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2408-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-73-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-75-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-74-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads