cycbot | be4f5e46090f5b1777e0ef23518d9e21c139bfcd4ef8f0b603658e86e6431688

General

Target

f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
Size

173KB
MD5

f78ed17c271f6ee6ec860dfddebfa271
SHA1

00ac754e90a92ba8dfd76e8ec4baed8024bb84d9
SHA256

be4f5e46090f5b1777e0ef23518d9e21c139bfcd4ef8f0b603658e86e6431688
SHA512

40889b5d960c30f053f7e9de876179e3e813a4245f1f93f163f360eb101d3be15f811a41c81b4ebd96ddfd30432784fc3f535b2dc394faa4a9ed9ef8af71d6f3
SSDEEP

3072:/CWWFMG4eW321crUVro+yCJdVSNJXA5pjX/sk6e2qZdyTQ34:TWvl12dCJdVSX8pjX/zLI

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3016-9-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral2/memory/3480-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral2/memory/3480-75-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral2/memory/3268-79-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral2/memory/3480-194-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3480-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/3016-8-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/3016-9-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/3480-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/3480-75-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/3268-79-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/3480-194-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3016	3480	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	82
PID 3480 wrote to memory of 3016	3480	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	82
PID 3480 wrote to memory of 3016	3480	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	82
PID 3480 wrote to memory of 3268	3480	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	88
PID 3480 wrote to memory of 3268	3480	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	88
PID 3480 wrote to memory of 3268	3480	f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016
- C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\207D.6BD

Filesize
1KB

MD5
0674d9cb1b1a2ac0bf72a52a92d9eb17

SHA1
527c37eb63ba19ae490bc4d7e5524809caf02fe8

SHA256
539c7e06c950420d3359d5622b767b0e29cf4f4a1a8ac24aa1a9c237f707898f

SHA512
89a1b697d6cb1c5b1359746bd122ada6fc79b4f6b78c22fdd7b6218dc268e7e5d0d06d2c2bf17b961c7d152306937c03fd657936c3afafec324cc07fc399b469

Download Submit
C:\Users\Admin\AppData\Roaming\207D.6BD

Filesize
1KB

MD5
0af8d8eb24e9649e9449b90cebfb5d82

SHA1
1b971332466fc93afb7009a35e5e3b10ab515028

SHA256
f5fc27040da7791041ceba0c8a017aae47b1d3ec44701fb60ec54cc2385bf1cf

SHA512
969b485746ced56d96400811b42d8cde9ed25c7dcb566d0a87d03b1a9fe3eabb1c41b30df03c1242e014a44ffebaa2a931b425fc8bf691106fd87afaf2239a4d

Download Submit
C:\Users\Admin\AppData\Roaming\207D.6BD

Filesize
600B

MD5
f53a4d4921c8475992f23f3bba964a49

SHA1
7ddd2f3ff859b80f7496ec216e83e117320f0083

SHA256
4e1db929b1ddb7f2378e7028da39bbdd92535b28779ceed19c85c86b424ae69d

SHA512
18585d3842b151987d363eb377a53a88a3b801a6b49a1a0a9911991995c8c6d974d618b6eaa8f645a7b00b7cac085a14c26abb822521ddf73728dba4c4ae9569

Download Submit
C:\Users\Admin\AppData\Roaming\207D.6BD

Filesize
996B

MD5
ddcf892d495fd535cd70677f1b35518a

SHA1
6a4cfed6112bdd10fa6007bbcea26eb582027d67

SHA256
17fbddfc622e7fbd8204d19d04e9f7cf73859fb999057162a51249be7ec6e980

SHA512
ae02d9bb2b9f9a0fc7022f625bf47418f500836a5518ec24614da75f88b5f9e91871a8897c03a6dc9c973f3286b61903094f562beceec17fbde30c713f7ad581

Download Submit
memory/3016-9-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3016-8-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3268-77-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3268-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3480-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3480-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3480-75-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3480-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3480-194-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads