cycbot | b2a0dc27945f178122b79c2afad14e4fe4a3232741703165e3a7ece31d4daebe

General

Target

fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe
Size

171KB
MD5

fd3fa6e12fe9133773313ba9f08cbab2
SHA1

75f336a7244aa3acf38201c4496d427fb750e8d7
SHA256

b2a0dc27945f178122b79c2afad14e4fe4a3232741703165e3a7ece31d4daebe
SHA512

271a98333e439cbacefd5ba994687d6616ff76ad27e2f0d156486733e79f4b20c41b04c1400e29a82fe9f09d60b94d570e71011a809cd46e391147b83773229b
SSDEEP

3072:QlAWWSspBqzrJUqnd/HY9JGQ11Or1qKAfdokTK/OF/kltwI7:vfbCrbnlaJDi1M5TdebwI

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2212-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2792-16-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2792-73-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1736-76-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2792-139-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\1C35B\\59ED3.exe"	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2792-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2212-12-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2212-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2212-14-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2792-16-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2792-73-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1736-75-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1736-76-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2792-139-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2212	2792	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2212	2792	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2212	2792	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2212	2792	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe	30
PID 2792 wrote to memory of 1736	2792	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe	32
PID 2792 wrote to memory of 1736	2792	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe	32
PID 2792 wrote to memory of 1736	2792	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe	32
PID 2792 wrote to memory of 1736	2792	fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe startC:\Program Files (x86)\Internet Explorer\D3A1\F59.exe%C:\Program Files (x86)\Internet Explorer\D3A1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fd3fa6e12fe9133773313ba9f08cbab2_JaffaCakes118.exe startC:\Program Files (x86)\5B37F\lvvm.exe%C:\Program Files (x86)\5B37F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1C35B\B37F.C35

Filesize
1KB

MD5
ec37a9d1ef3f1dabfbf1719f51aee47b

SHA1
7e42113c818a61e18e96599a423a0c70770ef150

SHA256
de6436cf01d6710f4117e0cc727c2fee31d1c8536ba7946af8687c97019c8397

SHA512
196015c8f151939fbf95f61695777b9769a279b023e4b74d4045d4e441d9230f8c4d2f8e9c42f2a37943c368c0f878b1e130a73cfcf97e43f5d2e8b311486619

Download Submit
C:\Users\Admin\AppData\Roaming\1C35B\B37F.C35

Filesize
600B

MD5
d39d42dd5b2143479c203fe65a9c7b4d

SHA1
84361a5e8c9a17df47303b781f48fef8b3a9db23

SHA256
24b7783587ad3bc25311c498a0e4176d81267a92b4f8dd9db8e53290a2e79830

SHA512
b73e3740439ed0e8993d6a2ce3f519cfad59c96b993ff95c6d03d63f9405d7e7a9db9633eea9b2eed2402e0d3991a19f582fc5ab58ef0104a0ed2c046cd0f3e9

Download Submit
C:\Users\Admin\AppData\Roaming\1C35B\B37F.C35

Filesize
996B

MD5
2529f874bee12128f85226736f2c90bc

SHA1
8bdf22dd551b23d97e5779b42450907d8892c3f2

SHA256
2c45d2e80db4377e70cb32fd6e9552e31168b77ccbe093b6d7f1aedc3f483392

SHA512
9ba090e266153c7ae487437c80a1a98aa9652afc6ef83d939c0f1d3f75d4da28a3bc0c10265085bd0975a971c26577381f0b6cd27214c6e61651f9170a0bf93c

Download Submit
memory/1736-76-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1736-75-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2212-14-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2212-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2212-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2792-16-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2792-73-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2792-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2792-139-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2792-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads