cycbot | 154824672670cccfa20288994f9082374eb0a1f37c69cbe25558eb9d7bf9d3f0

General

Target

febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe
Size

191KB
MD5

febbb4ae834cdaf431ccd431312929f1
SHA1

462e75001e6e706cec3e8cafb9a3712ff1d405fe
SHA256

154824672670cccfa20288994f9082374eb0a1f37c69cbe25558eb9d7bf9d3f0
SHA512

f71009dfc9c209ec0d44347897b17d057493b14a747ca4ebc993aa6c3f1d038f221a6526235c16077b7b011f7c6749ce882011dc8bd110792a413841a8123135
SSDEEP

3072:kaRbPvBJP/kSNvypwVEVaP4HjApRf3cO5mfegwVtF9Yd1c3Q8WqMkUnAK+iD3I:JvHXkS1ypwVIa+MpRf3cO5mfsVn9Y0g

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2660-6-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2232-13-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2356-71-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2232-72-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2232-160-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2232-193-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-2-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2660-5-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2660-6-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2232-13-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2356-71-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2232-72-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2232-160-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2232-193-0x0000000000400000-0x000000000046B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2660	2232	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2660	2232	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2660	2232	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2660	2232	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2356	2232	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe	32
PID 2232 wrote to memory of 2356	2232	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe	32
PID 2232 wrote to memory of 2356	2232	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe	32
PID 2232 wrote to memory of 2356	2232	febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\febbb4ae834cdaf431ccd431312929f1_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\55F6.026

Filesize
1KB

MD5
53231f058d795b5db1d53fe477df6382

SHA1
e23c842f015accd643280c1c8c19f13f3ea818b3

SHA256
8f58936bc209334963c7d59bad6ab24862f45c16fe7d74b2eb36ace246db6546

SHA512
1d4f433e7c0b3caf1ef176077f5d99993a15336f3450d569171c2456bd20442965a63fcb73b26d2472fc66261d141f0f8002269c571cecb6dac93c0dc57beae4

Download Submit
C:\Users\Admin\AppData\Roaming\55F6.026

Filesize
600B

MD5
228b7a8ddfa09caa8d5b901294f18a53

SHA1
4ab50b93424de0873d2c7d13d72f5d369682bb39

SHA256
9818e398a7274c7d65fe6cb1e8496a41bfd40c6b9c1e9f81da1566f6700b700b

SHA512
14f251df57d98932de72a9dc376ab38e81c83d239f6f999acb6718d7d091140c59c74984172bbd0f2900e146351faf4333167ece8a524966d33b464acf7eb5b3

Download Submit
C:\Users\Admin\AppData\Roaming\55F6.026

Filesize
996B

MD5
e4502cb9050867021b7b58069282e073

SHA1
529faa25b5c673a2c07505d10ca3dd0a8f4858c2

SHA256
1d604be195298c8dac2e17a23d3933610b31d46180bf54b18d0ad6d1c117e22f

SHA512
cea76303af95dfebc9956acd92ce33959a7def353dc3c43856c30579a195dcadecfad3e4515b1cbbe057557a57f8ebac76cc2458d9b0aa5b092a120d119b300c

Download Submit
memory/2232-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2232-2-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2232-13-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2232-72-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2232-160-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2232-193-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2356-71-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2660-5-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2660-6-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads