cycbot | 2194e3586812e02a34217a3595a401b2773d3f6a79e4540223e1db08020a5b1f

General

Target

JaffaCakes118_793b164fbc24330e512d3f739f113784.exe
Size

180KB
MD5

793b164fbc24330e512d3f739f113784
SHA1

91c0c1e5b0dcb4890706afde962dad0312e334db
SHA256

2194e3586812e02a34217a3595a401b2773d3f6a79e4540223e1db08020a5b1f
SHA512

6c681c60d0ef247f4f13990575cd0b50679ccfb823dc1e247dddd1c73edc033b52ecb23a13ed928fbe219af2f06596e3e964dfdfe1355c7057bb77b84e6db4e1
SSDEEP

3072:cGOkBoMfT2CXXcPhro8CwnFGUSzbMYT6rezPbEaWfXYyEDx2Kkk+DGavz5:cGOk6loXcJk87TY2rejbEaWfoH27k+yi

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/512-15-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/632-16-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/632-79-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1192-84-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/632-186-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/632-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/512-13-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/512-12-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/512-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/632-16-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/632-79-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1192-82-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1192-84-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/632-186-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 512	632	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe	82
PID 632 wrote to memory of 512	632	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe	82
PID 632 wrote to memory of 512	632	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe	82
PID 632 wrote to memory of 1192	632	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe	87
PID 632 wrote to memory of 1192	632	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe	87
PID 632 wrote to memory of 1192	632	JaffaCakes118_793b164fbc24330e512d3f739f113784.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793b164fbc24330e512d3f739f113784.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793b164fbc24330e512d3f739f113784.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793b164fbc24330e512d3f739f113784.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793b164fbc24330e512d3f739f113784.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:512
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793b164fbc24330e512d3f739f113784.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793b164fbc24330e512d3f739f113784.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\5449.B9B

Filesize
1KB

MD5
c2d90b55a9d0ffa752903eef9515a0a2

SHA1
c8675c8c70fa5e75c9f6606fad2dc63fae5fe7be

SHA256
cc46e5dc628bea9d2ea34440dae5391fe26e891ff065390ab3ee0c3281bc64bc

SHA512
a67070e92b560c9617e80b54293d6f0151b06b9e0d8d129cfc1e4125ea7b682235b024f7bceed742365f7cb00207e245e65ce92c854535157b9ec3c301c6d0a5

Download Submit
C:\Users\Admin\AppData\Roaming\5449.B9B

Filesize
600B

MD5
e9343cefd58de1a186f0c79062869a2f

SHA1
825330c94cde1bffc7f54c688ca29e7a5ad56701

SHA256
5f4661b51b8e99fa32af1a142b039cf2efd414145f5397a7c6c75284f6f8d053

SHA512
10718d756b672398325499fb65b37f29c7e644ceb6ade1bfe0203118e0b7fc95a7834e26805fb1ccc725819c4d126513fdfc1705633801b0c64be8dcc88242fa

Download Submit
C:\Users\Admin\AppData\Roaming\5449.B9B

Filesize
996B

MD5
e18e0d31547607bcc569ace207a022bd

SHA1
a16edcd99255453ee854af7090125c4c9c709e38

SHA256
ea8b302fa521f9be61c839fb255794df467cc027ba3aa1c648b10f87236d91d1

SHA512
6df373121488deab77fe5933a66041235921faf9501885a5a1bd434e6166610e451ff9c06f327373ed61088bb0c6a58021398694fba7440508317542e0d99deb

Download Submit
memory/512-12-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/512-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/512-13-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/632-16-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/632-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/632-79-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/632-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/632-186-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1192-82-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1192-81-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1192-84-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads