cycbot | be4f5e46090f5b1777e0ef23518d9e21c139bfcd4ef8f0b603658e86e6431688

General

Target

f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
Size

173KB
MD5

f78ed17c271f6ee6ec860dfddebfa271
SHA1

00ac754e90a92ba8dfd76e8ec4baed8024bb84d9
SHA256

be4f5e46090f5b1777e0ef23518d9e21c139bfcd4ef8f0b603658e86e6431688
SHA512

40889b5d960c30f053f7e9de876179e3e813a4245f1f93f163f360eb101d3be15f811a41c81b4ebd96ddfd30432784fc3f535b2dc394faa4a9ed9ef8af71d6f3
SSDEEP

3072:/CWWFMG4eW321crUVro+yCJdVSNJXA5pjX/sk6e2qZdyTQ34:TWvl12dCJdVSX8pjX/zLI

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2776-12-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2264-13-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2264-75-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2796-78-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2264-194-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2776-12-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2264-13-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2264-75-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2796-77-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2796-78-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2264-194-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2776	2264	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2776	2264	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2776	2264	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2776	2264	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2796	2264	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2796	2264	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2796	2264	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2796	2264	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D620.CF5

Filesize
996B

MD5
6b4bb3e1373b85d1f23368437a03213d

SHA1
d0dc9b5807f82c33f82bdf0a93f6c2c2994e3af6

SHA256
13c0f6e72cbbd774bdc003a61dc063c84ff5353a51f3fbd8413c37f3c429541d

SHA512
e4273bd00b9bd60f82446e99f637e6ba8e7157d02d1bd20fbbfcd0ca6bf4e1f6fe6c8882ec983663174404382f8d441b4f8e1b574205c49151b7a055d3b3c0cd

Download Submit
C:\Users\Admin\AppData\Roaming\D620.CF5

Filesize
600B

MD5
6c77895649fdbc86f46be3591855c929

SHA1
4d6a1057e7d104a2a21f8414e51e22aee3ea198f

SHA256
a5a46b701dd23fc57d88618e4b8b5e9aa4509648ded872de05499c2a9915604d

SHA512
43c016dc4780455d81a50d81390c3763e624cbe0aed18e5b1e83723ebd09de9e0656e677e1adc753e8d0c2626e27c7851673c8b8f658e1958f7bbb2e8ec35154

Download Submit
C:\Users\Admin\AppData\Roaming\D620.CF5

Filesize
1KB

MD5
2a6ccbadc1ec7e8357b396233860cf77

SHA1
febd5a02f50d9b9255206258e5d7e51d22668f5f

SHA256
be543f5c1e24da42e73ed10a22c76e5c9654fe0bc8e7ad90065caa0368137eec

SHA512
789148b0c3f02e3b499b14f7b5251a3acdc82bc11606bae93b5a7cd7da967331f948ff85cd8a0be8244f7af1d365ccde9327a98b70831fa0e814b074fc6aa614

Download Submit
memory/2264-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2264-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2264-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2264-75-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2264-194-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2776-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2796-77-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2796-78-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads