cycbot | 49da5a140446b46889082f0300fc4c106730d0d4a88547fb817b260d3d9bfc6d

General

Target

JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe
Size

168KB
MD5

790b6a8c21496860e8ee1e6209edda8c
SHA1

a3f6a0669989c06b5e448bef2d5970d29e78d0d7
SHA256

49da5a140446b46889082f0300fc4c106730d0d4a88547fb817b260d3d9bfc6d
SHA512

1eacfa1256625808533e6d8fb51751b8d9c14ef86205eb4278f5ea646863b5b906024c102c9267aca7365274044eab31e127588a7fd892a4cfd5991de3da5625
SSDEEP

3072:kUZPTMPn6/5Br8OWNO50zMyyxWE/jr4Eu2GVXKx+tUHKBbX6:pZPWnS38BNO50zMyS7rUIYZ6

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1228-9-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2368-15-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1312-80-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2368-145-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2368-195-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-2-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1228-8-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1228-9-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2368-15-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1312-79-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1312-80-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2368-145-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2368-195-0x0000000000400000-0x0000000000446000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1228	2368	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe	30
PID 2368 wrote to memory of 1228	2368	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe	30
PID 2368 wrote to memory of 1228	2368	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe	30
PID 2368 wrote to memory of 1228	2368	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe	30
PID 2368 wrote to memory of 1312	2368	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe	33
PID 2368 wrote to memory of 1312	2368	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe	33
PID 2368 wrote to memory of 1312	2368	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe	33
PID 2368 wrote to memory of 1312	2368	JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_790b6a8c21496860e8ee1e6209edda8c.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2711.926

Filesize
600B

MD5
8d7348eed14185a63fb2978fa7efbd11

SHA1
cfbbf84b086afdf18a78c01463a055dd462948b5

SHA256
e5926769093ea207e68bad95ef48626980835f478b275118d17f836fb0fcb5cb

SHA512
ea7fa1d1127b1a441d22e678c45919579ae879f951116502930e3f186204d8853fbb48cfc8165d3046550c3f181163698c86201a34e907b00120ba0ac4f5e7e8

Download Submit
C:\Users\Admin\AppData\Roaming\2711.926

Filesize
1KB

MD5
19f50297fa270a9748d25e9a4dbdfcd1

SHA1
104ffb13840aea912cf4e161a4923ed1c6228f6a

SHA256
8854d7b717bb39d9cc4ca83a468ee3f2832388f522df5161b0ec17b0ec535819

SHA512
65979e3625715c4650797751b0ac02f1e131b578902c63cb0da99aa69fc81c7c556cf8011514c86ea44f55af4e176ee15f29fffabebd7be593600b3981870f71

Download Submit
C:\Users\Admin\AppData\Roaming\2711.926

Filesize
996B

MD5
3e82437178b557fc879116f60ea11f13

SHA1
2f9ff00b0b5d1a188e15f777e45a42d33b21fbea

SHA256
97acfa415e11ded09e469bcc60859f6925e8f66c2e60e9a17577c33e4ca06fc8

SHA512
26455f39b4e4afc94408502b833e5f2ccc85b36016f30e7dda24f0dedb1a4c577e80f7785e86cc566076d17693db4d54e38306ab82739cd85126b57ce4b127fc

Download Submit
memory/1228-8-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1228-9-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1312-79-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1312-80-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2368-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2368-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2368-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2368-145-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2368-195-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads