cycbot | d03da3ca5d745d77460d6631ab83048ab8f903a16ee9eb366d1512082d995a33

General

Target

f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe
Size

169KB
MD5

f26bc562a9767d082ba245727f7ddbb7
SHA1

ad186a8fe87a991419786a175e04cbcd2cfdebd5
SHA256

d03da3ca5d745d77460d6631ab83048ab8f903a16ee9eb366d1512082d995a33
SHA512

78f098dec4c7cd7b5430f42bd93a257d10239c2b3e61ed112ca387230caaf28f44b70059ba37d3b7f7ced581a01dcaf78044eb609ed475ae3edd5242d1851c7d
SSDEEP

3072:kFGf+TNtlCM7AHW27DgRMQgsSPAmbvnTFC2JDRQReYc4BIJmUnWGMnqSR:HfMDk3cqF4UvMuus54u8jGMnv

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1628-5-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1628-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1084-15-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2200-84-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1084-85-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1084-190-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1084-1-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1084-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1628-5-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1628-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1084-15-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2200-82-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2200-84-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1084-85-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1084-190-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1628	1084	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe	30
PID 1084 wrote to memory of 1628	1084	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe	30
PID 1084 wrote to memory of 1628	1084	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe	30
PID 1084 wrote to memory of 1628	1084	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe	30
PID 1084 wrote to memory of 2200	1084	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe	32
PID 1084 wrote to memory of 2200	1084	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe	32
PID 1084 wrote to memory of 2200	1084	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe	32
PID 1084 wrote to memory of 2200	1084	f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f26bc562a9767d082ba245727f7ddbb7_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\5B2E.AD8

Filesize
600B

MD5
ef38f6634cb2eb0530a3bd4612a87f1e

SHA1
5d3c32bbd3a0198fe0ea3fb2cf551e259408d4e5

SHA256
45934695dde23e409c87fb4cdede26bec066cd960d08b6cc6b891259d449c8a9

SHA512
b6c492444aeac945603468869253e7c8401a7b5fbda7361a886a84a16b0f846f1b3671a7b6cd12fe790b30082c1791ef201936e341c12fc4f3b6df525feb56f2

Download Submit
C:\Users\Admin\AppData\Roaming\5B2E.AD8

Filesize
1KB

MD5
9c4ea78716e068d969b2e3bf8299c08a

SHA1
029bded96dbd6803ff23b0f4e86764a6c5ffb025

SHA256
5c70ea5b2668b3b1c4a5c27afe59b8f14f7408b35e61dee0bf5991ccabc73715

SHA512
a2cd07eec017e0d2636593e33f477dfb81a00e0b2afdffb69a3bb69120e48f514de56529daa624dffe92ec8a7e6f499c6b6cc3ce15fed7f90e9fd3659d81e984

Download Submit
C:\Users\Admin\AppData\Roaming\5B2E.AD8

Filesize
996B

MD5
1ebfc00a8ed91c2918950708e0376a23

SHA1
949639c13474402dae9249957208660e88c5fd87

SHA256
cfe19564fff0dcca096b5655a4cf8416e61ab5c62ebb668cd01818f413675d10

SHA512
3376a15b03ac7c2de70f8b762156bbd4468300bf6d2d8f28983ba92ed45b7ad0dd4ec99da64bb0b71ab8f4ab2fbd8b0e74223cb59db88c67ef66e544d42e3d34

Download Submit
memory/1084-85-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1084-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1084-190-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1084-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1084-15-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1628-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1628-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2200-84-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2200-148-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2200-82-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads