cycbot | aa6a148220ba43ed6c86f81eabd09c864d47f0392e12c0440f3205caef80a3d5

General

Target

JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe
Size

178KB
MD5

685a16e5561b8a0e821c19869fbda726
SHA1

31d91ac30b93bbbd272d7f437f07e9e127b78ef8
SHA256

aa6a148220ba43ed6c86f81eabd09c864d47f0392e12c0440f3205caef80a3d5
SHA512

c15542aa4a63ae3c5e906ef312f9ed873cc0acb0b5ebb3e30c9045e752b0de0adeb51c2fb9e466dbb88ec7565bfda69ce4d1d13f1ce54dab4632f4415e4dd715
SSDEEP

3072:EQBVyS6IvAFI+KEpHxbupiw/CPNfPA01GNaP0GXLrsv5c5IY81fpPXkxLF2ukO5I:EWywv81dupieEA01C2Xsve5IY81fpPq9

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2544-18-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/2420-19-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/2420-76-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/3356-78-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/2420-189-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2420-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2544-17-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2544-18-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2420-19-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2420-76-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/3356-78-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/2420-189-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2544	2420	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe	83
PID 2420 wrote to memory of 2544	2420	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe	83
PID 2420 wrote to memory of 2544	2420	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe	83
PID 2420 wrote to memory of 3356	2420	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe	91
PID 2420 wrote to memory of 3356	2420	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe	91
PID 2420 wrote to memory of 3356	2420	JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe	91

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685a16e5561b8a0e821c19869fbda726.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\944E.61B

Filesize
597B

MD5
dbdf4a80c046c2eb6019ab99d1933734

SHA1
cc810269b375715e84c8ecf17f34ba26063f4814

SHA256
db18839c22c912f1143b291556ba15e324933cf2ef335e8fa310ec7b2324f34d

SHA512
64ec29924e2c0f91e40ee0d68256a6d0aaa6cfaf5974307ccccad71f6782025d16359a618b69ad0504095e5b61d1a765f534da78764223eb38e5e01f73e04b56

Download Submit
C:\Users\Admin\AppData\Roaming\944E.61B

Filesize
1KB

MD5
31199802a9613801dad2e7bb449090ed

SHA1
215fe4d25794f736e4eb1cabb7503732fe309af3

SHA256
eab8ad96ed98ec24c780f3fcd28cf668cc4170db88ddd3f96a3545629550dc58

SHA512
1378cb31b778730e8edf16d49cb1f70e30b50ad37d68cd711a2de2bbadc4b2f1124474cdc1ddba0213e2c41ff4609be9ff87979a4aa70a44c66989f26b29cab7

Download Submit
C:\Users\Admin\AppData\Roaming\944E.61B

Filesize
1KB

MD5
3ed53f1a2eddf84d44e49c062f05a5a0

SHA1
c0fd8423a1e07a7de2f61238eccdb161ae609b4b

SHA256
b488e09120c9a7e60be747a0574514b278272ba0b8dbf11142b9217a55982825

SHA512
b87104f6a671cdb9e865666687634b8c0bcd72e1790ee3798814daa6be798cfe682de30e660e14c77796158d1e71006737e65f2505669f0eec59d885fcc9be68

Download Submit
C:\Users\Admin\AppData\Roaming\944E.61B

Filesize
897B

MD5
284fd0532944a0f88b36357ddd2356a2

SHA1
1949f487bbdda5a07644d90b7eb1a9ff91e001bf

SHA256
f51ab4604ec347e6ae5a5bb77e716baf5ea8c1c740db64759baa6fa4197efed7

SHA512
4899d0fae02d9555dc8c4ddd1a4edca4655be05167250dd89e0dee5043dad231df5016c1fbd486d74c53d76d7d3fee7d8c4812caff4e314efcafdaa15dd5068f

Download Submit
C:\Users\Admin\AppData\Roaming\944E.61B

Filesize
1KB

MD5
4561ba54f8652a4681969c19e0086518

SHA1
fca96b1bcafe38bdd75a508c2dc70dcdcbc4e271

SHA256
39b4425ccdcb6bc21eb2470f9bd1d765e18fe57f94d83b9dde02228c3093a0b1

SHA512
481c32d91e39a09f02de38d8ce64072a26af9972d93b759212327b5d3b78985f27fa9e23b9925d9dc40ddf0447331647382da0a538270b2cc8cf18b308d791f4

Download Submit
memory/2420-19-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2420-76-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2420-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2420-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2420-189-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2544-18-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2544-17-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3356-78-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads