cycbot | bc4e184421188a6f3899f637bf3074f0fead80f806e069cbcd7e11d0640b5301

General

Target

ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe
Size

175KB
MD5

ec0b8efafb6aa8043ce6e923ab6e64be
SHA1

6b8cc0c2430750d1d4b2a2a0d190a95eac46bb8b
SHA256

bc4e184421188a6f3899f637bf3074f0fead80f806e069cbcd7e11d0640b5301
SHA512

8c6d34f349504dfc840634a14490b9a77088d025efc58acd7177981cffe0695bfaad154708be0d4abeeba1891f2f67ed0d0887b61020426c6a532b8a195ded46
SSDEEP

3072:hjM1X4NZ8POD5njLC8qkFcmphvg3Ba7Ecti0d5rsyTvOL+kb041Av8A1:iZ4NZaMLC8qkVvma77t9wH+kbHs8A

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2872-7-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2872-10-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2872-8-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2848-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/3036-87-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2848-88-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2848-164-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2848-1-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2872-7-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2872-10-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2872-8-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2848-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3036-87-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2848-88-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2848-164-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2872	2848	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2872	2848	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2872	2848	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2872	2848	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe	30
PID 2848 wrote to memory of 3036	2848	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe	32
PID 2848 wrote to memory of 3036	2848	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe	32
PID 2848 wrote to memory of 3036	2848	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe	32
PID 2848 wrote to memory of 3036	2848	ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ec0b8efafb6aa8043ce6e923ab6e64be_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E7F9.B2B

Filesize
1KB

MD5
71750e4bed4bc7e42f8764e1000c5e39

SHA1
0ce9d21569d37ed41f950c6a75492dd6c98535e9

SHA256
2f3f92bad7a8bd43d4a88419dfacf3686a53ce7c6f97838aa24814ddd62887ea

SHA512
4ee81d9a7eaea640e176626083327cf226d5f21ce3d9f7f522b3a13cbff1b0426b2fa1e5cde8debdfcdeecb2b378ef8bb0882d539e419eafc44a685f1eea2124

Download Submit
C:\Users\Admin\AppData\Roaming\E7F9.B2B

Filesize
1KB

MD5
4de3ff172f8fb770a731a85f27188729

SHA1
4977db91c40f3a144de7840781030c7f3ca59fdc

SHA256
0dd7e559c1177c139d2f868e2ad0f8411bfb205e1fd33fb80a1fef062f514fd1

SHA512
01cff4daa504b2161db7e51d77a07ba22a0b434f90f32952dd0dd02ac2d74594c23ab65ec299b8dea191c2df9ac7a5ee9019fdb1e0856e37640acd42e670b037

Download Submit
C:\Users\Admin\AppData\Roaming\E7F9.B2B

Filesize
600B

MD5
623198417ae20a7394b005014988b544

SHA1
5a26700fe7cbc7e6074db3e2d96803aa5df6fa79

SHA256
efa559d2b6daa49898b6c9a14cd8845f239ac1dc2800034db26847b4f174b21b

SHA512
9d3b778d211fbc70c9e1086f6828fdac8e815375890856a5e7b132b7fa987cfd8709a7e87c9c22a989fb8468e7c135845077a20a3613c2f3ee4b9ceb1bd3cab8

Download Submit
C:\Users\Admin\AppData\Roaming\E7F9.B2B

Filesize
996B

MD5
6a426418153baddc81d8276c36fed55c

SHA1
39e2b59f2024cca9a2a55cdb869597850e86df97

SHA256
4d281d4d2fb5f972af0136c8c3affa383b579f1dba4dddfd895f8477a3d67a1d

SHA512
92d9b94031afa8f8f99b0305db174c47541750f259dcb95fba0e5ef0164a26d0b952db056941a1f9697cd814b2d7291b0fef439b16da942d087484fd87a3aee4

Download Submit
memory/2848-88-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2848-164-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2848-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2848-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2872-8-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2872-10-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2872-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3036-87-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3036-86-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads