cycbot | e2ead13305860473457e83aff6e6bca3174550c0b083da77a84088b19b1f7048

General

Target

f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe
Size

204KB
MD5

f9fac6949fee882cd1ed1a0a2f9e4751
SHA1

816997c66473f7bd37aa58a56f233b4eb5992ba2
SHA256

e2ead13305860473457e83aff6e6bca3174550c0b083da77a84088b19b1f7048
SHA512

642bd5609b11990c97442f2cc039eb052cb33c54f59de8b6e915cc264add735dd7c5d3d20231518cb59219f1d634c7fc97f55034c53031f88a016bf7ea465643
SSDEEP

6144:4WPB2ADacX/5u6AMxFy6N2Sb0+PZew5W9:dPkADacUTMxFy6lQoA9

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1964-6-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1964-7-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2508-15-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2508-76-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2716-79-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2508-188-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-1-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1964-6-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1964-7-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2508-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2508-76-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2716-78-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2716-79-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2508-188-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1964	2508	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe	30
PID 2508 wrote to memory of 1964	2508	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe	30
PID 2508 wrote to memory of 1964	2508	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe	30
PID 2508 wrote to memory of 1964	2508	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2716	2508	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2716	2508	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2716	2508	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2716	2508	f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f9fac6949fee882cd1ed1a0a2f9e4751_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2ADE.53B

Filesize
1KB

MD5
d26887347cf841e8c16fb846d52d49bd

SHA1
f88d30521636dce8de2acb92946365d3119c6859

SHA256
3c759cfd1e2abee95b6194e39796fe567eb136c82819a09fb2b5a3d61f8b756f

SHA512
8acb41f110deacb0189f15877a7172395f2338a3b61c01a19ac17f50aba36b739e16f61c2f12d3582a5cbf8dd54ab4840b643c05d0489e9d261fadb7baa3979f

Download Submit
C:\Users\Admin\AppData\Roaming\2ADE.53B

Filesize
600B

MD5
51018c8ed1943330c8bbcde89ef0894d

SHA1
c5322a8b1604d4b14216d87a338fe41c15b0be1b

SHA256
775dca8f21cc19f1370f7dd10bae195c910ea5329dc299fd531d99ec39e11e1c

SHA512
fd6d11679ffb90c319087d0f68b3a696ce3866dacdade4959a1d067d4d3952d2c4f9c73d526e307aeb72ca8958e6714d6b5bcb7dcceed97f309de0afb049fb4c

Download Submit
C:\Users\Admin\AppData\Roaming\2ADE.53B

Filesize
996B

MD5
d16fb82f0d74d970269f56d99aa46227

SHA1
d4eda41e073eac512bb29a37bca4c9a6853b8c82

SHA256
b1133ad174b96ac1e06750916f44ebf3e0d4ec83eed6f1e09d1be5f2c81c4400

SHA512
329da2bfe41e7ae4405452c1ba552a5b38bad05caba502fca6b1c0aa18562a2111413535b5df6f6e4296411cf1ba8f7cd2fd7e073b3eb0d8dee504882742d6f1

Download Submit
memory/1964-4-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1964-6-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1964-7-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2508-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2508-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2508-76-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2508-188-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2716-78-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2716-79-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads