cycbot | 93e73e8f74de69a16dc2bdbdb9ce1ee8c3d684a1a6c3e6de033bc9494ce4dd4d

General

Target

JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe
Size

163KB
MD5

789e1b6b60f689349f205b860ea72f66
SHA1

3121b5bf18e3857a389c2bb7fc4a1ae562277ffa
SHA256

93e73e8f74de69a16dc2bdbdb9ce1ee8c3d684a1a6c3e6de033bc9494ce4dd4d
SHA512

ec4904f86c84131abdac3315987324808e75cc206e4e6a9c5271f555e2a9c0f22d7d37d7cf19fc55b8d92a2b1c6a2d68f6ad7e90d1e330ba00e8fa30565b6881
SSDEEP

3072:6gnH7p4Pxsw1PyMG4cM7hhiy/Ww6lhXjJ1SZYBepL4:6gnt4PxswFyMGGSy/Ww6L9QeBgc

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2344-2-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/1712-7-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/1712-8-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2344-14-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2340-84-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2344-141-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2344-186-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-2-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1712-7-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1712-8-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2344-14-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2340-82-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2340-84-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2344-141-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2344-186-0x0000000000400000-0x0000000000444000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1712	2344	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe	30
PID 2344 wrote to memory of 1712	2344	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe	30
PID 2344 wrote to memory of 1712	2344	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe	30
PID 2344 wrote to memory of 1712	2344	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe	30
PID 2344 wrote to memory of 2340	2344	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe	33
PID 2344 wrote to memory of 2340	2344	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe	33
PID 2344 wrote to memory of 2340	2344	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe	33
PID 2344 wrote to memory of 2340	2344	JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789e1b6b60f689349f205b860ea72f66.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8656.252

Filesize
1KB

MD5
cdf4431d540b579dfbec57246d18d58b

SHA1
41326a03235cea0a00fad53475d596dcc35a19ba

SHA256
9b9445b503e1cff68fd2cf89aa3bfc57c8a06a7700ac1959d0185187df4b07ca

SHA512
fb62f1994bba3de03df603eed4f5ddf77a8892299a0a6d778dafada08e4a9f4b6699722260fb38cb03b5e9a70d34ebb5540836b572e6d05423c2d3af0240eae8

Download Submit
C:\Users\Admin\AppData\Roaming\8656.252

Filesize
600B

MD5
a39e0d2b32bc9d40725dc332db7cdfad

SHA1
92395bc8e83daa9a485ac631e2503742a8e7447a

SHA256
407cc7ec9dc2521526b513217e18a2bbcc59f205eb788d5c64c9d6d4d82456dc

SHA512
61c4db823543b23771f416b7ae39ff8e0d8dc1ee6bb8e1db2d129a8b78199f9f73162e2209efe3bef33ba4c4e5d53707599abca82e899d633c8649a8bdf36566

Download Submit
C:\Users\Admin\AppData\Roaming\8656.252

Filesize
996B

MD5
5db135f46151cd3fc39cb4bc12966bac

SHA1
c38114f9d5bc87ae40ed4a755d783747a5feae4b

SHA256
61821871bb7f17c53e1e1ae91e5bfc246d7004c0484416c96233892649ada6d8

SHA512
8f60739feaba3fb27101fc8690441398687ebc8b3a7e53706194e132b1d948334691bc36c242f9932ef2c38f644b24ffdfdfbcba3e4b5e7ffac7defc14ef51e8

Download Submit
memory/1712-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1712-8-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2340-81-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2340-82-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2340-84-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2344-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2344-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2344-141-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2344-186-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads