cycbot | cef11f66033cfcc37e24b2de23562cc90d21962acd9721885bee8654e7311c7a

General

Target

fea3efb5b6099354021277333a698838_JaffaCakes118.exe
Size

198KB
MD5

fea3efb5b6099354021277333a698838
SHA1

037cc59dd6eb5dc1ffc6feddeb065750b5342b7d
SHA256

cef11f66033cfcc37e24b2de23562cc90d21962acd9721885bee8654e7311c7a
SHA512

8d5d9b2fdca8b584bd1a4e0f303331075d286999eb872c4c9a9ab3c29f72ac5edd3573bea650f4c0a990e95324223b7cf0d7ac8200277f2341da70442f4d5484
SSDEEP

6144:uo7EUsijmBVRJG1ye8qOrn64BVdG42ug:uoLjQfDe8qOr6+f1

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2024-8-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2292-16-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2800-81-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2292-82-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2292-192-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	fea3efb5b6099354021277333a698838_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-2-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2024-7-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2024-8-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2024-5-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2292-16-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2800-79-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2800-81-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2292-82-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2292-192-0x0000000000400000-0x000000000046D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fea3efb5b6099354021277333a698838_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fea3efb5b6099354021277333a698838_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fea3efb5b6099354021277333a698838_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2024	2292	fea3efb5b6099354021277333a698838_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2024	2292	fea3efb5b6099354021277333a698838_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2024	2292	fea3efb5b6099354021277333a698838_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2024	2292	fea3efb5b6099354021277333a698838_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2800	2292	fea3efb5b6099354021277333a698838_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2800	2292	fea3efb5b6099354021277333a698838_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2800	2292	fea3efb5b6099354021277333a698838_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2800	2292	fea3efb5b6099354021277333a698838_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\fea3efb5b6099354021277333a698838_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fea3efb5b6099354021277333a698838_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\fea3efb5b6099354021277333a698838_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fea3efb5b6099354021277333a698838_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\fea3efb5b6099354021277333a698838_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fea3efb5b6099354021277333a698838_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C824.185

Filesize
1KB

MD5
7863a4d7eac8b1435921dca80347c393

SHA1
13ade8495a33522711394fb3bc4fabcdf7a95f17

SHA256
5cbb9df403b313835ad34f580e484b0aaa1198f7ae9356c3fecb8f5d8e0d09f5

SHA512
a6d81e636d1e122cfb2f9e87ce25d7c0982a5fcfbeda5a41d8b5d06271ffa58b2aa0fecb260c736b3fe883f5c73061e813ab1206ec53ceff0c896450b42a4121

Download Submit
C:\Users\Admin\AppData\Roaming\C824.185

Filesize
600B

MD5
0a89d0784d01e83c4d1d1e2e2b2350e4

SHA1
e09a49bde80ac2335fbdab882756606f885c7c55

SHA256
6faf00108ff867147aad2bd1163ea884cc0394d07386553cbc80f19118789997

SHA512
8d3ec9a1c35a991745a44e27ea691498511575a2ced91ce62872ddcaffbd51caff2ecaa0f8a6e1f39f5fc9550f7395f870205ae1a22ef26d294d166408df8864

Download Submit
C:\Users\Admin\AppData\Roaming\C824.185

Filesize
996B

MD5
1e367698e70201be748619585a0be86b

SHA1
1c1b608a9caadea6f8a6f2494fa22a763a720053

SHA256
9f7ffc87673ef3a3832b843fca969303fa1127ade39e68d6cb4b2e168406ee1a

SHA512
8281d700b501b54f5516e2f63a487be3eea805ab0cd4ab28d34162e6748fafe274bc1616ecae46a115262c2aaf280f808a253091128e70de2554165c845952c3

Download Submit
memory/2024-8-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2024-5-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2024-7-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2292-16-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2292-1-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2292-82-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2292-2-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2292-192-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2800-79-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2800-81-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads