cycbot | e1c673dabe9a00662939ae5ad0dce3bcf81aebed0b21bf51f2e49b220bf63ead

General

Target

f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe
Size

182KB
MD5

f7b2f2255010c0f47614dd4328cf8de3
SHA1

28583e79542d08552365c38b690b5bcde7de699c
SHA256

e1c673dabe9a00662939ae5ad0dce3bcf81aebed0b21bf51f2e49b220bf63ead
SHA512

12954920361eefd4277503f17f3431e45316c93bd6b6ece27df2d023f9eccb7c5d2b730ca0708538404621273374f817842e8e18b1fbf341df15895eb1a10603
SSDEEP

3072:I0p0irQstIKCPyLnN8pVTezgIzfFe6Lp91uSmY8C0qoaIoJH/9BiupNH+JLFAFYh:5QsuKCPyDGpVTez7fFea+SmY8C0CIoJ/

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1792-7-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2412-15-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/1572-79-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2412-80-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2412-192-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2412-2-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1792-5-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1792-7-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2412-15-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1572-77-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1572-79-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2412-80-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2412-192-0x0000000000400000-0x0000000000443000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1792	2412	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1792	2412	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1792	2412	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1792	2412	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1572	2412	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe	33
PID 2412 wrote to memory of 1572	2412	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe	33
PID 2412 wrote to memory of 1572	2412	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe	33
PID 2412 wrote to memory of 1572	2412	f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f7b2f2255010c0f47614dd4328cf8de3_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\11EB.DEA

Filesize
1KB

MD5
ab78b6b9df7666cfc6cea502c6fe5f9c

SHA1
668950fc8e634e1c3f2c4bdd20b71d737b5ed50b

SHA256
307899c31aea9ff5522f4634d68680b6cfc76128f1f6ad5d9c41b097eaf3f0d0

SHA512
d75f2ee48e62f0aa17e50bc3e16cc0e4957bf3fb09e0dcd9db8824ee02c7c3b2801b100186d1f08df35b5c70e271b0ec10aea4b19368b5d028a847c237c598ab

Download Submit
C:\Users\Admin\AppData\Roaming\11EB.DEA

Filesize
600B

MD5
0ff572644f6534297cdd19987dd0a20c

SHA1
97a1e9d87ff5ac0c211e1f377aeba0b6e40305bf

SHA256
bca04e17873367b2954e82b1c0fb7b0e98106a852c71d6c2a8a84a68765f515a

SHA512
5ec91108e1e05a259b0ab22d14bb1dd97dd9c3381e7e4caf41036d3090561fe8a7c55ee9ca3cc17e2576104ee0dbc42dca945bf2b97571ceaa048c73e34aaade

Download Submit
memory/1572-77-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1572-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1792-5-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1792-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2412-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2412-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2412-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2412-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2412-192-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads