cycbot | 8df096d7ac5fbbf87d5f117c370590f0f177f5963e873171451af1a5674ce521

General

Target

f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe
Size

168KB
MD5

f83d393ededf2766adf11b8e51015a33
SHA1

ff07e287c98c842ed42e0fbaf8147d3f23f06a6a
SHA256

8df096d7ac5fbbf87d5f117c370590f0f177f5963e873171451af1a5674ce521
SHA512

70a4bd41aa05c53b44c439d5f6c9fa58425a23b520915bc5a2ba7b74e899d199fa5a915f12c95b4321477f8bc66e1745ca955f5bc17207e243184e8d0fe7397e
SSDEEP

3072:k02RCXtj4OB2EEkxjtiLz00T1pOYvcEr4SF6Evm3b2syXxAP:n2QdR2qxjtiX00hcE5xvUHyhK

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2528-14-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2324-15-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2324-82-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2640-84-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2324-201-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2324-2-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2528-12-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2528-14-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2324-15-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2324-82-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2640-84-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2324-201-0x0000000000400000-0x0000000000444000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2528	2324	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe	30
PID 2324 wrote to memory of 2528	2324	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe	30
PID 2324 wrote to memory of 2528	2324	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe	30
PID 2324 wrote to memory of 2528	2324	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe	30
PID 2324 wrote to memory of 2640	2324	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe	33
PID 2324 wrote to memory of 2640	2324	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe	33
PID 2324 wrote to memory of 2640	2324	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe	33
PID 2324 wrote to memory of 2640	2324	f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f83d393ededf2766adf11b8e51015a33_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8500.B31

Filesize
1KB

MD5
141274c096503b722c0178d8f8c70120

SHA1
d0e749c65428780da415e414918d7a89a3c35b84

SHA256
1b59b84cd426ed307df7a2ad02fb8e610f1073ed679cddd30caa0092d26bedaf

SHA512
ed2d47a26c2dd2e2fbf9001bd5087f5c4a791a03ea37695f507fbea546bddd3e49798764e7bdca3d8af18aa2f3585a2dece10665e251ba7dfd92368042d456ad

Download Submit
C:\Users\Admin\AppData\Roaming\8500.B31

Filesize
600B

MD5
a9b7c0c61c5baa08fcd05b11d8866e2a

SHA1
953d42560638ae2b131f03913f66885cb250f535

SHA256
cea72c15abbb24a5fa21fb9b9717685c6c0a49678df1401e62d84a4a129b7fa0

SHA512
9a8607766056ac3b1c4efff413a421d57e617a830ed77ef19acefb23ee1a1e30af15b39938a52d228562319c6bd49ad9fd1143d427a813a6094726fbdddee191

Download Submit
C:\Users\Admin\AppData\Roaming\8500.B31

Filesize
996B

MD5
a1a62d912a9204ffb5d876a0098a3ce5

SHA1
8d333988b9fbc587068a6a3075a501d945f0fcd3

SHA256
3e54d8ff0e3ff831bfbad53e82e5d887c92bd3c751e91a13468cac5addff357d

SHA512
673e983a916662ce5f7e0f643f1c4567f62a2790b1908a277c9f3fb2291e3ad80ae21e9f07eb0cea8e11b77c960db5a9489195063ac16b817f27f87e87cad464

Download Submit
memory/2324-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2324-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2324-15-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2324-82-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2324-201-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2528-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2528-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2640-84-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads