cycbot | bc0dbd26df952b1e47ec4a579c90c6a0f08f29de7010ae2c35d62281a23a4fbd

General

Target

f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe
Size

163KB
MD5

f0f4f1c17faaa147cc61cada662bfc78
SHA1

4ebf2f320d5792b84b7c5bc285a428bc60dd5ce5
SHA256

bc0dbd26df952b1e47ec4a579c90c6a0f08f29de7010ae2c35d62281a23a4fbd
SHA512

ed5a30cf2aaa131a7eebad91254bb114b5a78f6a93ffa9ddb59ac1fb40f5197f70bdedc0dee0480a77b4179bf06f86a4a3aea804b9251cb6c20ee10e5f6eba93
SSDEEP

3072:bG3TIkGjKhx+s+u0OGc8dMKAPmGyJFXMOSf7lbwn1JZWY+pBH:K3MkGjOx+qFk95emvZWYs

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1680-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1680-12-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2396-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2396-80-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/876-85-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2396-201-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2396-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1680-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1680-12-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2396-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2396-80-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/876-83-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/876-85-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2396-201-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1680	2396	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe	30
PID 2396 wrote to memory of 1680	2396	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe	30
PID 2396 wrote to memory of 1680	2396	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe	30
PID 2396 wrote to memory of 1680	2396	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe	30
PID 2396 wrote to memory of 876	2396	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe	33
PID 2396 wrote to memory of 876	2396	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe	33
PID 2396 wrote to memory of 876	2396	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe	33
PID 2396 wrote to memory of 876	2396	f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f0f4f1c17faaa147cc61cada662bfc78_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CF1C.759

Filesize
1KB

MD5
f3a6e78cf1c4ef492fc347107c73810d

SHA1
f88984e9a7cc815954a9a29913aaa960cac9a343

SHA256
07b4d7488123d0570ae2f3deddad874b2f32d5611a931fd6be4a5dc522d8b429

SHA512
0a9e7fa918273424b82f9d88b2b9e2d89fb24b3d00f484a6bf259f7514e0af3625a0a979bd5f3fd7e07e00911da0c59789514fee39c3567b7dd7e7bd6426ca47

Download Submit
C:\Users\Admin\AppData\Roaming\CF1C.759

Filesize
1KB

MD5
c93ceba78407a83e1c0eb2b910de3e90

SHA1
0dc45ff1dfb99e1576d94293a742d0f7d84873e7

SHA256
d649b982cd2b0efe51cbd75ea6fcef117228beb30c29277207a6c86eb6cff0c7

SHA512
5256de27459284ba54ad4ec1e1e50c8277fc86685d5c37c3d68bc850a2fabdb5d7a5117bde064ca249084b54786c8676ad17c38ad4d42482426591c0c059158d

Download Submit
C:\Users\Admin\AppData\Roaming\CF1C.759

Filesize
600B

MD5
8e3c738af35da3857e7084bcae690b1c

SHA1
fb3c9fd37b93be41e3eea7cabaabcc71d46cf3bf

SHA256
ba571a7702184828b573a7af8d9b4f06a6fb76e1f288a8c70dfd86ffd9498be2

SHA512
2f6c33925d5dbec6cc277a31bcec09ab4d6da95dea981be5be1718dc5ecabcfd3f72a248c6f0fdf0dd9f7cb6f4951558e9032ba3b5c2b8b46e8dae1c43ac26e3

Download Submit
C:\Users\Admin\AppData\Roaming\CF1C.759

Filesize
996B

MD5
88180e4e3a264879291a427341501ffc

SHA1
b717ea6193e20bdb21249a993d12aba21cc76fa5

SHA256
6dd6dffd753940abafd6b0bf2506a7bc9d4bc81457329292e7d5b3e7348b1a91

SHA512
9296b41e78be990c31e459312693f6596b80ac604e7ff1a2e2b815845cab4197bd1f48b6b7a4bf440252aebeed1bb6c06876d147a5690b3b2c8a947ae9f64fbd

Download Submit
memory/876-83-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/876-82-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/876-85-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1680-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1680-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2396-80-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2396-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2396-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2396-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2396-201-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads