cycbot | 752d0cd60368012e67bab2bd8d83f67b56bfad56b251fac7e5c80d44a5fb0684

General

Target

JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe
Size

175KB
MD5

6df3d652cc7983929411058cbc48df35
SHA1

89673b7eb0b5fb60c82545ccdd30ab278be0d561
SHA256

752d0cd60368012e67bab2bd8d83f67b56bfad56b251fac7e5c80d44a5fb0684
SHA512

4b5bf6b2493101e6552305e4d7c633c8242076761d19c73daa2f2b12b7a2c22d9c5e691481d8a50fa7412d5c51940c752d7f4579ee211684be42123e226a8609
SSDEEP

3072:Ih7jRgR49a7tsjZlsTq0Rp1Gc3JWQavS6oCAShstweQx:y3K4w7tsj701wQHCvh

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2456-9-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1100-14-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2456-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2520-83-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2520-85-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1100-144-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1100-191-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1100-1-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2456-8-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2456-9-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1100-14-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2456-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2520-83-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2520-85-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1100-144-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1100-191-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2456	1100	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe	28
PID 1100 wrote to memory of 2456	1100	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe	28
PID 1100 wrote to memory of 2456	1100	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe	28
PID 1100 wrote to memory of 2456	1100	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe	28
PID 1100 wrote to memory of 2520	1100	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe	30
PID 1100 wrote to memory of 2520	1100	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe	30
PID 1100 wrote to memory of 2520	1100	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe	30
PID 1100 wrote to memory of 2520	1100	JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df3d652cc7983929411058cbc48df35.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6D1D.2E5

Filesize
1KB

MD5
050105bf31bb2d5c5e3a4292a760ed31

SHA1
0c2172807d73b208a586449e3fe433fade9330e7

SHA256
83be60cf52ce04430465a0c73c9a5ffdbb95f772fe47e0c3ce600385c9e53b3d

SHA512
f009080b8feb78e1472df48f61cf02973b9f30780cbf9aca6bba69cb87fcbb438327939d510dd4535c30972c5e49e51619132729ba3b1db0f6799312f010cc87

Download Submit
C:\Users\Admin\AppData\Roaming\6D1D.2E5

Filesize
1KB

MD5
de40e4519ea18e71b8ff23b61e6ad368

SHA1
8cffa7cfd7c0cf687dd1b77da40c1689959837c4

SHA256
484e505e8b8e80b511ce1ef9fb5ef41995f9426a9cc51fdabd14e74b8fed3f00

SHA512
248c0a98cf94281270b1c225dd28f526f5f6e64f02b3d9971320ba6de773e5a552db558cf45167f310ec51f9886b656cb6dde0d8ad89bf396a27587a3fe2ba41

Download Submit
C:\Users\Admin\AppData\Roaming\6D1D.2E5

Filesize
600B

MD5
1ff69bc454d79d8244251556b6df0f37

SHA1
33593e04f731a5cbf1173aedb3dba721a90ec10a

SHA256
4b83992363b549f2d912a0c46d9be72646786dad063f5025ceae3f17449ac860

SHA512
4829dc2f78b4c0ba0280ea338f76efd190a1ba75c0c3771c48df3f8d8d13e48b146b836f5fe75916778fa01064990e42377ffa6962e7c23192f2983e7128f0f8

Download Submit
C:\Users\Admin\AppData\Roaming\6D1D.2E5

Filesize
996B

MD5
3bbde30c805b9c58c1b0803431c9a19c

SHA1
6a97747be29b711036d81ab068a16d575d49b710

SHA256
be3176a11969ac9d5572e66608a4cfe5ff3dfb77d9a575ae521b205c15a58d61

SHA512
1f04f1e6935b599be12fb7728e5198f09e12641b4c82b6d8637c9b81d7751595587c2bb6884baba5116be2b5a7d36733094420f98d2303ecc0c4b0e94a8ac8ad

Download Submit
memory/1100-14-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1100-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1100-144-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1100-191-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2456-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2456-9-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2456-8-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2520-82-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2520-83-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2520-85-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads