cycbot | 5e0d1f48c2afc14ec65a18430636d8e5fd0a3b3a145099d971a7a77f55fd3069

General

Target

f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe
Size

156KB
MD5

f98166e2a74293580ade21fe5a51bf21
SHA1

ccedd2c63a00182794d8da557db50e985685bcfe
SHA256

5e0d1f48c2afc14ec65a18430636d8e5fd0a3b3a145099d971a7a77f55fd3069
SHA512

5f425b00fc722760a0491fb31867fc3c637bf41b74fcbc34109fee3ae75559afc4c263a5855262d68ab20f935df60337014b836b244e0124cd218ebad561e945
SSDEEP

3072:N04SFxQrRV8tTdV/7u7nGq/D/FOfo6tFY//z57AgunAe6yhlJ:e4SkdezVju//1XV7DO6Kl

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2516-6-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2340-14-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2340-76-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2652-79-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2340-173-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2340-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2516-5-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2516-6-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2340-14-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2340-76-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2652-78-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2652-79-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2340-173-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2516	2340	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2516	2340	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2516	2340	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2516	2340	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2652	2340	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe	32
PID 2340 wrote to memory of 2652	2340	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe	32
PID 2340 wrote to memory of 2652	2340	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe	32
PID 2340 wrote to memory of 2652	2340	f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f98166e2a74293580ade21fe5a51bf21_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7AB2.143

Filesize
600B

MD5
0aefe48cd8e1f16246b4946f78cec6df

SHA1
35fb4d1f218061fa22a6e56374a8efb6110334af

SHA256
cea0d8cde6cac322e268e4ee46d8056c36ade9778721f74e983ceaee6b2593b3

SHA512
16bfefbe6e8566659d5d973e8f6c59a9eae223b42713c75ab7efcf9ba219421f02617c2332cd47ef67411d74c3e15ff489708bfe1767b3d6c254ded82be15407

Download Submit
C:\Users\Admin\AppData\Roaming\7AB2.143

Filesize
1KB

MD5
6455632b831d7eb513247270cfd98409

SHA1
59b9669485f6e336bc37aa126bceb2ed4b95b725

SHA256
c83a827e72b522757c7a3709d76ebf16f10922c3ca8e8750fae52c584051d8a0

SHA512
e98421d217e6b34e1aec0298079715cfc61f5b6923ab9826bb10957d82dd1856a9202d4c8126b352c3a85df60aa1d3b8324428142707ba230084fb1422507e2f

Download Submit
C:\Users\Admin\AppData\Roaming\7AB2.143

Filesize
996B

MD5
2563e121088849e214952d69f874894b

SHA1
0adf129cfb6c2e0de4c572c2e3cb80afd4333617

SHA256
c6581ce5df4e38359b46763c951f613ac6839c13dcafd3b4abd4a953f4b05484

SHA512
e873813a9035e870dcbf4948f39768e7cbf0dccd3fee6c7d0a0dda00e83e21376395b1ff3c55eee71218f9cd124a45cbef2b27de01ff7789a39f09fc4041eeb0

Download Submit
memory/2340-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2340-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2340-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2340-76-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2340-173-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2516-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2516-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2652-78-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2652-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads