cycbot | 5b21f602ef96da6394a1731f5c93267a86f86f3b0b6bf95e59f8ce6ea500297d

General

Target

f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe
Size

278KB
MD5

f8791cd1534ff1bdee355b251eb14761
SHA1

1e8b28ef99fe1867b84b5e415c639405f8422339
SHA256

5b21f602ef96da6394a1731f5c93267a86f86f3b0b6bf95e59f8ce6ea500297d
SHA512

9cbb00a854da863aa3cbbe9f818360ad89da13d978ef9ecf637ce7293e1b0dbd69dd35f2bfff1c0caa3d0a120003b635ae6e4543bff72c6e2fd91f9ffa71fe93
SSDEEP

6144:426dfYFuJqqNqo8E6i4kxnYAXfqXLwEHbYoSckT4Au6ZGR/fm7QEU:jgDYqL2kxnYAUvxk0Au6c+K

Score

10^/10

cycbot pony backdoor credential_access discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/3000-14-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2336-15-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2336-78-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2996-80-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2336-171-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2336-173-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\1B271\\5EED3.exe"	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe

Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 1 IoCs

pid	Process
2868	56D7.tmp

Loads dropped DLL 2 IoCs

pid	Process
2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe
2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-2-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/3000-12-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/3000-14-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2336-15-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2336-78-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2996-80-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2336-171-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2336-173-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\LP\D3A1\56D7.tmp	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56D7.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3000	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	31
PID 2336 wrote to memory of 3000	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	31
PID 2336 wrote to memory of 3000	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	31
PID 2336 wrote to memory of 3000	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2996	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	33
PID 2336 wrote to memory of 2996	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	33
PID 2336 wrote to memory of 2996	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	33
PID 2336 wrote to memory of 2996	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	33
PID 2336 wrote to memory of 2868	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	34
PID 2336 wrote to memory of 2868	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	34
PID 2336 wrote to memory of 2868	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	34
PID 2336 wrote to memory of 2868	2336	f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe startC:\Program Files (x86)\LP\D3A1\94B.exe%C:\Program Files (x86)\LP\D3A1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f8791cd1534ff1bdee355b251eb14761_JaffaCakes118.exe startC:\Program Files (x86)\715F7\lvvm.exe%C:\Program Files (x86)\715F7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2996
- C:\Program Files (x86)\LP\D3A1\56D7.tmp
  "C:\Program Files (x86)\LP\D3A1\56D7.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1B271\15F7.B27

Filesize
600B

MD5
12aa2f9d061a1518c7489dbaba1bd0a0

SHA1
69b568bbbe6d53f7639b3e820684cf053abafeca

SHA256
912f0098712572ef27e7608740cc21f5a892cdf56b743986566eeb71364bb7ec

SHA512
92506d49d0282370b8135a9117e110b0744306e62060b8c0a8c3ba0e6672e40dd5972c90dbc709e39560b13994ea1d56a71c516af9661b0e66a606f78669c01e

Download Submit
C:\Users\Admin\AppData\Roaming\1B271\15F7.B27

Filesize
1KB

MD5
9078b995b6edc4fa9f1b1675227ab20e

SHA1
bbb8e7631df8127df685461caf179c8bec0ff126

SHA256
beda5749796c88fbab83af033a6cd64ab67ed4db04724d66efd7ffcf4d1f2185

SHA512
775a500c99b7c2b845a5a2b2a5b581dbc974c37c270e3a51cf8d18f7e71d147e8d4d05afad4084ec8f118e7fd8779a975cf7f6747b955af265629863e636b53a

Download Submit
C:\Users\Admin\AppData\Roaming\1B271\15F7.B27

Filesize
996B

MD5
76b0b2ef006ee6bc98ac802bc934e4b4

SHA1
ce6a2a693cab2636eb1cbe1a0135979fec09c78a

SHA256
154499eb1aa29b53c9fb2748f468099bd67bf5b0c7732ef40a3c9634ac79ae5c

SHA512
0d45340212e2a5c16857ee46fc2f95860fd00f5d52b27adec1c3cad376963c491612988cd305c8e1868653383d6756ca40e37192fafac205882cefaa948c16d4

Download Submit
\Program Files (x86)\LP\D3A1\56D7.tmp

Filesize
102KB

MD5
0d45adf3b36475949d7382fa78c68258

SHA1
c3bed91e18fcd1b1a194049eabea626f486a26bc

SHA256
64e8e1cc7eecf9fde81a72ede03851b36c96d36551fe78fb335d3bc1edc49a7e

SHA512
f28c716dba65177141c0f5eb98d3e159db7fb690bb5b5e7168275e77f9cbeb2baa84435dc45979c578a4345c26aff3f8d9cad4987371643116377eaa4618bfd0

Download Submit
memory/2336-15-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2336-1-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2336-78-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2336-171-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2336-173-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2336-2-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2868-169-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2868-168-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2868-170-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2996-80-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3000-14-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3000-12-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads