cycbot | 063e2921799de8768c47a43ddb6e231750ea1cccce23251783e4a4e6d620c4c3

General

Target

f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe
Size

168KB
MD5

f0dbcd3c1585b55c99428780fa74d24d
SHA1

542e8e0c2ac9a433c4a9838d9de1517edc0e05cb
SHA256

063e2921799de8768c47a43ddb6e231750ea1cccce23251783e4a4e6d620c4c3
SHA512

524729103085d754f520e3edd5690cc9daefec2c03f56d25c94c3a1f71bd91ba95ca8d24797e92634c28b8f2775b51995d7a20c9db68424a4b227965d31d314b
SSDEEP

3072:PFh2I8BLRpR6UToZUCJ+9qo6lz6ffwduXn5ifcynlT7rlLr6W1/oeyHNW3jf1Zy+:PFP8BVpsZn9uX5ifcy5Jr6WxZytU1ZCO

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2536-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/2064-17-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/1956-82-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/2064-83-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/2064-182-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-2-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2536-6-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2536-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2064-17-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1956-82-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1956-80-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1956-79-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2064-83-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2064-182-0x0000000000400000-0x000000000043E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2536	2064	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 2536	2064	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 2536	2064	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 2536	2064	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 1956	2064	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe	33
PID 2064 wrote to memory of 1956	2064	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe	33
PID 2064 wrote to memory of 1956	2064	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe	33
PID 2064 wrote to memory of 1956	2064	f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f0dbcd3c1585b55c99428780fa74d24d_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CFE4.E96

Filesize
1KB

MD5
e7c0ed432d151a3be7cc74811ae6255e

SHA1
68c3a356a4cadedc8d039a4eb4221333855debdb

SHA256
502cf6260fe44697ef4d55691aafeb1d930272a1b5663ac01632742083e0828e

SHA512
56d4cd80e592a72731e1f45dd816e1d7ba939d91b72e01582d3b87de8ffaf7a2684982d6532244511365ab565f5810646b3e6d5cac82ad8d5bffb52176993691

Download Submit
C:\Users\Admin\AppData\Roaming\CFE4.E96

Filesize
897B

MD5
308e8f41c5027c4b430ae04c81bb9522

SHA1
f2917d25779fb93d7e86e24bf73558e75519052e

SHA256
68608d959f1454e1a36e45a0de615078061cedd655aaa2315b0274055cd53f8d

SHA512
83bf82f8846c7e74bdbcdbe2670d651766e35c4a39697b81e4e9edcdbaa32feb41d1531c74043e0f71f12f916d4d9a991d19801588101dcaf2afc904dbe96e0b

Download Submit
C:\Users\Admin\AppData\Roaming\CFE4.E96

Filesize
1KB

MD5
214aaecfc0416a31751d20ad6469c8d0

SHA1
7b894075b2d56f7bbe6fa00b58f64672ad23dcd1

SHA256
c619639df7f4266f67e6e6cd8b979ad6a901a7f347e703d3ad4d0a8f3ca03d82

SHA512
34216a6f884d60ae532528f44afa3a54326e18f9934074786c9127ec359b82abcbd3c0c3c0ec28ce8ded66b1b27b31c75f9bb0d2fd9ff194882f367c340de7f1

Download Submit
memory/1956-82-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1956-79-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1956-80-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-83-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-17-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-182-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2536-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2536-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads