cycbot | 7872d6bd81f83ae74492b5724bf9cbb69feacb37450cfc5269a719eb1caf0ce8

General

Target

fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe
Size

184KB
MD5

fdbb13ab3047f47d961b7bb814717b0c
SHA1

b9521309c9241b87867f1bc96d66cf5629f2543b
SHA256

7872d6bd81f83ae74492b5724bf9cbb69feacb37450cfc5269a719eb1caf0ce8
SHA512

2f6c5a69e4c0d43355ddfbe8e32dcb04ff9d0b12214f39ae53dbae87b1a2a7d4452de6832e7fbb286831c88660b8cbf80d6b1b46eeaa124b0ce49f4e0f8dbfa5
SSDEEP

3072:evX3OzJxnt5hxLqPFRs+eEDv0qv+CUqZiu034z3k29eFBtYV8HhC/u8t3uwL:efAVxeRnPtZR1zUgJVMhC3t+wL

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2324-14-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2324-13-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1700-15-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1700-77-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1508-80-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1700-187-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1700-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2324-14-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2324-13-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1700-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1700-77-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1508-79-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1508-80-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1700-187-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2324	1700	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2324	1700	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2324	1700	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2324	1700	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe	28
PID 1700 wrote to memory of 1508	1700	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe	30
PID 1700 wrote to memory of 1508	1700	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe	30
PID 1700 wrote to memory of 1508	1700	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe	30
PID 1700 wrote to memory of 1508	1700	fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fdbb13ab3047f47d961b7bb814717b0c_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4DA2.B1E

Filesize
1KB

MD5
f64c3595ee67af0e49587047df5efdc1

SHA1
9e4414f7f3d899b1b9218c62419d885d257ccc67

SHA256
3dcf5e3f98199eda6e09594e09dd5a9b4ff1547dc2bfce55cfd8e427b6a06fcb

SHA512
2b0e054ad759392b96b243f82617df24eb1fa7b6f3985b65fd7014e3b1b4877a5335cb134a60060d442a7bddc1c75af961e3639d84db631ea5f8b410978354a0

Download Submit
C:\Users\Admin\AppData\Roaming\4DA2.B1E

Filesize
600B

MD5
841f63960b463a51f425504bfd440d13

SHA1
5289f4cb3377df39289d806eac2b3f18d77233c1

SHA256
16b4f224822c235b325c236d47c7ecc820a1386ae6f1d43ec8b43cf2a5a36c83

SHA512
058f537afef53381852f79792aab74acd0ec646393fd04acb02d7864a17b55872f4ee8b48113c1fb2decf920787e7c10188f1d6cd2a00879816fece205a55829

Download Submit
C:\Users\Admin\AppData\Roaming\4DA2.B1E

Filesize
996B

MD5
dd4d6fe1050687dd0bf06974b5e8cfdd

SHA1
f66fd039458eb4bcc96ca1677f19412fc8e6a632

SHA256
f0a94410abe6859964bad7b8ccb0021c208209f5f0ae8fdca3d49463f0c30192

SHA512
560edfe87262a693f128d528f82901706b854d10cef6b74c10ef1981126ec7e4bbaf1a10b31ba933b8cea3b984a876383b7789ed03865ddd36733297302bfd58

Download Submit
memory/1508-80-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1508-79-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1700-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1700-77-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1700-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1700-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1700-187-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2324-16-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2324-13-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2324-14-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads