cycbot | 35a887f5eb0904c6b397dfedd868ad7fa436b864d1185fd376b9155ce1874696

General

Target

JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
Size

174KB
MD5

62cf181fb2fd82475dafafd74539ebf1
SHA1

332e45941b06e60f42a8d2a08cb833d275277abe
SHA256

35a887f5eb0904c6b397dfedd868ad7fa436b864d1185fd376b9155ce1874696
SHA512

e259aa2b1eca2bda64a25f5036662eed2c446d004ae49d83cf77802f8a6cca27c17bb222cb602b8bd21314e9d0cc224e95b887e52525f3ae10a60dbc8d73c8e4
SSDEEP

3072:8EZevKD5vXDrqYlhqs+5YM7CEdaPWRfsg3rJVIu0TOsKWX1:wKD5fDrqOhqsnEdBfv9V/0TOsKW

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2932-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2660-16-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2660-73-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2192-76-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2660-153-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2660-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2932-12-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2932-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2932-13-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2660-16-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2660-73-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2192-76-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2660-153-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2932	2660	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe	31
PID 2660 wrote to memory of 2932	2660	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe	31
PID 2660 wrote to memory of 2932	2660	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe	31
PID 2660 wrote to memory of 2932	2660	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe	31
PID 2660 wrote to memory of 2192	2660	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe	33
PID 2660 wrote to memory of 2192	2660	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe	33
PID 2660 wrote to memory of 2192	2660	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe	33
PID 2660 wrote to memory of 2192	2660	JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62cf181fb2fd82475dafafd74539ebf1.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B04D.2DB

Filesize
1KB

MD5
b71ef1b13b17bd64ce73d5d82de828c3

SHA1
6ce4ed8a029076cd9a5e602836b1b13952567a6b

SHA256
bb9b2e203f64da028b3b225d26b99c9652be62eae9c30a06e7b882e5ecc37b08

SHA512
153a0260a20f3b87f1e68f175c11852db74e4ea70618b647355479c166509bfde9161aa3a3d3d7cc69fc06921eb155cfe2651fdcaa015576f31200ce5922a247

Download Submit
C:\Users\Admin\AppData\Roaming\B04D.2DB

Filesize
600B

MD5
694de9e70dc24a0e6042f9f9c19fa9b4

SHA1
6ba3570a5619f198b32cebe6256a262e38ca991b

SHA256
b143e182505cb5d04fd5bac83e68c230e02ed87cdac085438551d211290c0dad

SHA512
9364c644be7f800664a4f700d2392532a944bf9a2f4b0dfd8c4b10b24345a2aafe74cc224eb82e86fd4738664e203553f5d53f88e49fa80a86449c3e1689c31a

Download Submit
C:\Users\Admin\AppData\Roaming\B04D.2DB

Filesize
996B

MD5
d3f57fc5bae17fb722c9df4bf7e3f91b

SHA1
cb15b12977adf1e682ffdb3ef6ab22f086b95cf9

SHA256
05b36c43c265b9cae31b8846ff6387f57a793c747282358c9c4c2af3bbe20c23

SHA512
33ce5ccfd56a855579c1ca6bea2c2ac0c700daf0bed1389c67d4250de9534fdec7e942f862fa070dbc62829a6b4bbc111aec9ef0a25cad2ca20733484958b1ef

Download Submit
memory/2192-76-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2192-75-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2660-16-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2660-73-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2660-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2660-153-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2660-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2932-13-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2932-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2932-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads