cycbot | e2ce2ca491f48506257a74cdcfbdef4559139bd7d6e310afcec7d387ca883d92

General

Target

JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe
Size

158KB
MD5

6c7bb4113a0d58f807b5b9e4969c5218
SHA1

7cbcc835ea606c8fe2bf92080a48466c573dbaa6
SHA256

e2ce2ca491f48506257a74cdcfbdef4559139bd7d6e310afcec7d387ca883d92
SHA512

7ac69a5962fa9c83a51481ab391961f58a411f153c6a8c6e9bed5d7ec2fe8ce37aa1dbf7b19f8e78e71dc17f05ac94434bdd86126492793104381bd162a1293e
SSDEEP

3072:1BYpozFC6+q8FjGt0u2GVrbA8F8sZLc1uCuVSjcwTPAaG:1WpcFCbfu1A8Nhc1uDSjHLS

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2416-7-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2324-18-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2568-87-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2324-88-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2324-193-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2324-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2416-7-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2324-18-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2568-87-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2324-88-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2324-193-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2416	2324	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe	30
PID 2324 wrote to memory of 2416	2324	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe	30
PID 2324 wrote to memory of 2416	2324	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe	30
PID 2324 wrote to memory of 2416	2324	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe	30
PID 2324 wrote to memory of 2568	2324	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe	32
PID 2324 wrote to memory of 2568	2324	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe	32
PID 2324 wrote to memory of 2568	2324	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe	32
PID 2324 wrote to memory of 2568	2324	JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0602.808

Filesize
597B

MD5
bda0e6f3e2d07f2d732dd9257ed62ed5

SHA1
c6f0df0d74b97a03383444d2cc6bf37ea13b2205

SHA256
f4822ee8ae97340bc6c3e4b7113c8d6c6818648da631bf23d1d9dd6e5851f62f

SHA512
852756c01840c9e3f898f45f38ffeebb3c15048d9abc1e59b29fc527337756c5f38a095a75180264eae61b0a8f2c031bc239803efb358596da9375797c289e24

Download Submit
C:\Users\Admin\AppData\Roaming\0602.808

Filesize
1KB

MD5
b0d5e2630892b5d37999a6a135b870c4

SHA1
cefbadf1644b839b05758544c969b265cfdd3cab

SHA256
f0e24d2a839bba6fe53bd30bf7981960fd22c6d9638f1f36d9c3e25ad5b7d8e8

SHA512
ccb06dacc06f997bb759f9af6554472fcfa8bfe5d3f50b6cf151119e99955acc2f93307e88da31ff7e98b298720fbf6c52e5dd88a0fc7a04529be382999449f6

Download Submit
C:\Users\Admin\AppData\Roaming\0602.808

Filesize
897B

MD5
049e59a50ea0f2069ac2006fc66b870a

SHA1
c80e67aee54f32463791ff5d034461cc441f94ba

SHA256
5fe47dd5719f9b1252dccc89275ece7fa19ad792edcb13581d783c170b5374b1

SHA512
bfa53ba0ada75cfccbefefe76252d6037334bff5cbe9033a797e6fe8bf884f488c88d3b52c42d9062dc207e09a243b87759251cbcce81de6ffeb9951f250bb0f

Download Submit
C:\Users\Admin\AppData\Roaming\0602.808

Filesize
1KB

MD5
52e409694b24227cc908a1a21926033b

SHA1
1dbbe393e0b2973d6e3130e4b6eec8d604e62962

SHA256
a27902f60d2681ac34d3fc0ad9d213ba190dabd53186a3b1ae009f953e6bc28a

SHA512
2b54bbfb7da79d3095b62b1bead82637944e83fb61bfeeaf986ed3668e61447ce1bfe125c577cf0d18628098033a4629611394071f77635a25fa7c4f36b1f0b1

Download Submit
memory/2324-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2324-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2324-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2324-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2324-193-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2416-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2568-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads