cycbot | 449585fc596b7edbf0a1d1457a8549ea022cd982da51ce11b3f7ca6a9a083895

General

Target

ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe
Size

182KB
MD5

ede2bf51f73977d8e4f845fc7fbeed5f
SHA1

981ae7f5bbb2429e5f3c77428115b7bbc2f4d69a
SHA256

449585fc596b7edbf0a1d1457a8549ea022cd982da51ce11b3f7ca6a9a083895
SHA512

ce327b4935f5be7b155f0e232ef70f14fcab79a68d567c2b8ad70e5a65f5f549abfbf974ce6b0392735d29c98a97be642d902d7ae382c08cc9c1ad97e35a9f60
SSDEEP

3072:gcZxvg8aGCyU6ufzh6VXL+WT7pWxDg/InX/9EgTqTCqOGmGDDpOWFPPlGMU4i0:gcjIdtfEVXL+S7pwgAX/9xTbf5GfPFPV

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2164-6-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2164-7-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2396-16-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2116-75-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2396-76-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2396-191-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2396-2-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2164-6-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2164-5-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2164-7-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2396-16-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2116-75-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2396-76-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2396-191-0x0000000000400000-0x0000000000443000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2164	2396	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe	29
PID 2396 wrote to memory of 2164	2396	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe	29
PID 2396 wrote to memory of 2164	2396	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe	29
PID 2396 wrote to memory of 2164	2396	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe	29
PID 2396 wrote to memory of 2116	2396	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2116	2396	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2116	2396	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2116	2396	ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2164
- C:\Users\Admin\AppData\Local\Temp\ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ede2bf51f73977d8e4f845fc7fbeed5f_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C427.123

Filesize
1KB

MD5
296158698e735bcb01352b1179a45a1d

SHA1
5667ece9b16c0c8d165f7aa76b8fe240b092d71d

SHA256
66ab4f1e52341c2f321fb63d94b4b0c968031912a806072dbf1f2c957cb862ef

SHA512
22950691897b994bd6b21025ec8be2fafc67dfc42530373318700bf827905ea443ed4882893974ff298298888c9e6f8d9ade87e5d7a64435c6d0305bcc7893cc

Download Submit
C:\Users\Admin\AppData\Roaming\C427.123

Filesize
1KB

MD5
907191c6c129c715b3b2b4354c7f8b11

SHA1
9bfdac03aa82d1b9260713b4521c6a48692233ce

SHA256
48fa42e7132a3c7f60a1116434b1e02c2a3b5f578d4bf304f728c9acd9cfa32f

SHA512
14caa42cccd23a3169f46df7fa5b884d1554724740fa24d6f161f829ace8ab6d01d86eeee65d7c93bcf6f7619fd75234caf52b65990c08f6dc6c37f4b8022d01

Download Submit
C:\Users\Admin\AppData\Roaming\C427.123

Filesize
600B

MD5
f292a85baeef19ffff6416d3d12beb43

SHA1
1601232db9a1be18490989b5587fbed1505b998f

SHA256
901b2216a465f216ec4e2238a4a234ef73e997316d2251a8fb47604601b8cde6

SHA512
fcbd32bf2ccaf71a83a4ea7dc042979e430218aaccc1e63090b09f156ba55bfcd7f34aeac157320eacac90783d7ceb8cccd8b4d409a8a19786e83823fb312a44

Download Submit
C:\Users\Admin\AppData\Roaming\C427.123

Filesize
996B

MD5
10fb64588efb339a403f18367fc731e3

SHA1
405a04774de8aea0aa8e12413e58b9bb7e55981a

SHA256
945b9dc9b8ecde552372b2ae7b648dd9b37a3fa526c3b68697f8882c919d6b89

SHA512
9e5249dd6f187cfafbfd077d4b04d91ad46853701046716ea139e280629df8c8af60804872e308061e42fabea477010eb736a527557cbfe14ddc34c294412e7f

Download Submit
memory/2116-75-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2164-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2164-5-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2164-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2396-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2396-76-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2396-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2396-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2396-191-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads