cycbot | 378db5f9e702725b5d3539c735a53dfce657dea52a667a91a9490f1e9bd3eed6

General

Target

ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe
Size

154KB
MD5

ee84976567206eed31eeeb8b6ca2c4a8
SHA1

4ac85ab5618890bb9e678964d5e10f555abf5fa7
SHA256

378db5f9e702725b5d3539c735a53dfce657dea52a667a91a9490f1e9bd3eed6
SHA512

0f6c4fb5c3a577a5fc5435e79159109197aef31995729a7da891f68fa6a2ecf942e5b9210bf96155fc4a466ad6c12e6d9f62d2b539d8b6a79d289bbe7ff584b8
SSDEEP

3072:apG6p7PrDi/FRC2voecQEYW4qyHuvV1xw2LEgieVMWSCE7KVl+lxU/KNL:kH7PrDKF03YWB6IvWsldSCAXa/KNL

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/3060-8-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2964-19-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2964-84-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2864-88-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2964-188-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2964-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/3060-7-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/3060-8-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2964-19-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2964-84-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2864-86-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2864-88-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2964-188-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3060	2964	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe	30
PID 2964 wrote to memory of 3060	2964	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe	30
PID 2964 wrote to memory of 3060	2964	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe	30
PID 2964 wrote to memory of 3060	2964	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2864	2964	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2864	2964	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2864	2964	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2864	2964	ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ee84976567206eed31eeeb8b6ca2c4a8_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\28BC.9DD

Filesize
597B

MD5
1a6b9a5d1a424c961475f8f46591e720

SHA1
79ecabf9674b3a8754ca3453c9066c79a137619e

SHA256
cd6697e2de5f176c1fea8d0131ec4330096a4cedd36daaaa1abb780385cb101c

SHA512
60ac6d1743e8a904939ba93b5aa9f4c18d710537b036cf919fa10d6cc9b8bd6249c46d3ae012d233f0b51f9b95b554699fd6830e880d095d19cda7a818f1cde6

Download Submit
C:\Users\Admin\AppData\Roaming\28BC.9DD

Filesize
1KB

MD5
a51daefb72eea1288869fdd8d7e33b76

SHA1
0f0a43d73cd8af72aec86cea1c791e04cb1a08a2

SHA256
f3b0b9578c6cd23a73cd72320188948d1065b0dbce0bedb4574c419e9ba6c016

SHA512
e28db38dbdbf53fecfbdbb1305eb5c78ec6f431d4d9b1c643bd472fa7e95fe7d171af262888318017afff9c55a33c071febc525fc64d6e7543781f39b90dee40

Download Submit
C:\Users\Admin\AppData\Roaming\28BC.9DD

Filesize
897B

MD5
f3c7849c4779ac0652f7eb64b03750eb

SHA1
ef3b5458c2e9ec4cb587a30310d7b83e4eafd5a0

SHA256
de9ff3dcb6851dd2351540a5b5f4fa8c7c3715beec07fcd1ce7a19f157778a48

SHA512
57c4e7e13f41c5dbf56aa0404a76bf7e5e06a3f95aa83698e1115ae1195249741cbf522e4e00fd994080f02186eb6ca9e777e9c2c0f3f9d166574325859e80f7

Download Submit
C:\Users\Admin\AppData\Roaming\28BC.9DD

Filesize
1KB

MD5
fb92fa5f1da92f33d3f0ac926a8997fe

SHA1
424c6059b425a66c263bbb5f534fa87cef127e5c

SHA256
d9e75232b4308f8b2d674fbca8ea7228dd0e15c2d74a120dc25742afc0837ec1

SHA512
c33241eb6f3fc63e59fe96ae629ae5d3a4393999f8946e75b08bb70fabfc84993960236a0642ebbade9c93e5365924ab1b79548c968e6597188ce9479121bc12

Download Submit
memory/2864-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2864-86-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2964-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2964-84-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2964-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2964-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2964-188-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3060-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3060-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads