cycbot | bb81c43ac789ba1ff6323f2ae93c619012de472adcadb255e139d277acec0d78

General

Target

ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe
Size

169KB
MD5

ff8069e9df5f033f25ed3cae4c44d26d
SHA1

c16b25ad819057d8c7d6e1aafb9b00506cd32fe0
SHA256

bb81c43ac789ba1ff6323f2ae93c619012de472adcadb255e139d277acec0d78
SHA512

b50c454980208fbce74b7a8d085ecbb59d83f90b0556dc1d328d9df186a1c2631c4a8fd3b0afb616a7cb0f11801acf784e384fea89ba82fce7b8a774fc7122f8
SSDEEP

3072:qlnLPV0bgNVZ7lZimggJ57lyrEquWN5tQ57ziAx5ClB:qlh0MimB5IELSGOw

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2868-8-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/2668-18-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/2000-82-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/2668-83-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/2668-176-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot
behavioral1/memory/2668-211-0x0000000000400000-0x000000000043E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2668-2-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2868-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2868-6-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2868-8-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2668-18-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2000-80-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2000-82-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2668-83-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2668-176-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2668-211-0x0000000000400000-0x000000000043E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2868	2668	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe	30
PID 2668 wrote to memory of 2868	2668	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe	30
PID 2668 wrote to memory of 2868	2668	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe	30
PID 2668 wrote to memory of 2868	2668	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe	30
PID 2668 wrote to memory of 2000	2668	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe	32
PID 2668 wrote to memory of 2000	2668	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe	32
PID 2668 wrote to memory of 2000	2668	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe	32
PID 2668 wrote to memory of 2000	2668	ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ff8069e9df5f033f25ed3cae4c44d26d_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F890.B96

Filesize
597B

MD5
a53d3be6f90d1d7175e1cb6d1266e326

SHA1
d52006bf9dc30a50136e73883cf4064692adae4e

SHA256
91d5f0fb86c5f4e8cc567caa1d5adc63dea2d22ba5b601fd8855102df28e1248

SHA512
a890c86248cc79fe3dd3bafefa3f7662caa89e5f8ec6022a1a550d4affd069462ad8d789b3160795ecffa9e5a8055d3ac4a508e3f1f2e7ae720a64e154b0a199

Download Submit
C:\Users\Admin\AppData\Roaming\F890.B96

Filesize
1KB

MD5
95f75023ab7544a52987722c7907236c

SHA1
dd82e82f61024091b9db5163061619c2cab21dcc

SHA256
5b067c0d9d175d133fa89e65f1fdaea75863b139343706b3cdd2bbfb4cab8eef

SHA512
a75426bd487433af341e3815019f76a82013d7aa3fe6e48f64da958705d4c69f687599a40e3ce3c194c765418498f977aa31476f2a74015c75d739f97a3bf960

Download Submit
C:\Users\Admin\AppData\Roaming\F890.B96

Filesize
897B

MD5
bde8391ce0d6d354a9c3e2973b299a7f

SHA1
0c62ed554ee5605113311b79a12301f5efc2b933

SHA256
0adc7f76409a41162669ad857019c76f2e82bdd39228b6802684619146be53fc

SHA512
9634ff06ba4f16c15645e8cf6b4e9b5c545a18ca3132b668a0933505e4092580b67ca4f035fb1e2dc0a775bd75f0fc87bd3074851465a0e3426de443d9382b51

Download Submit
C:\Users\Admin\AppData\Roaming\F890.B96

Filesize
1KB

MD5
f2b714750a24803067b4f18014ed3e73

SHA1
0027900dbf8aae3103a23c9e5ebd9cd69c834267

SHA256
d69ca092b23c91f41cb8240dc7a97d2cb001fbe5e1a96ac5617f5df611cc65a3

SHA512
bca56c5c219b56b0c30c4c48dafadcffdc929d39439706c9dfc8bdccb4947a85ec8303b34b5570a9eee08f162530c1f6512bdb194115fd08048fee02b6603276

Download Submit
memory/2000-82-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-80-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-18-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-83-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-176-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-211-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2868-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2868-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2868-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads