cycbot | daa4921943b0246c9ac158ff8abf2ec6a04b0b46734cdbb1eb063f326d7e040d

General

Target

JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe
Size

176KB
MD5

793f365a3221c67b0399b132ba1dbf16
SHA1

54cd106498717c71cc796ad9d30ec9ec81803333
SHA256

daa4921943b0246c9ac158ff8abf2ec6a04b0b46734cdbb1eb063f326d7e040d
SHA512

d7b7196506d605af5441c5ab14b87a48ca1f05d69eec1acb19be40c6cbb7326504c504853e56bf30e840cb1374f11011c13b641ab9becdd89224a3d7fa79e076
SSDEEP

3072:j1YGVOUOmGWweuWaYneGV5qSfoWtyMUtq8kMYZbSbdtiSUU8fE3k55V8aW415cTI:smGWweuWrneGXfoWhUtXmbSJVJiKaWoC

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2016-10-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2016-9-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/1592-16-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/664-79-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/1592-138-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/1592-188-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1592-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1592-1-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2016-10-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2016-9-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1592-16-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/664-78-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/664-79-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1592-138-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1592-188-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2016	1592	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe	30
PID 1592 wrote to memory of 2016	1592	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe	30
PID 1592 wrote to memory of 2016	1592	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe	30
PID 1592 wrote to memory of 2016	1592	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe	30
PID 1592 wrote to memory of 664	1592	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe	33
PID 1592 wrote to memory of 664	1592	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe	33
PID 1592 wrote to memory of 664	1592	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe	33
PID 1592 wrote to memory of 664	1592	JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_793f365a3221c67b0399b132ba1dbf16.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\020E.3EE

Filesize
1KB

MD5
121f78ac989d3b1067a64ce91873b905

SHA1
3e37ee118d4f101352c21d87b1d92233eb25277e

SHA256
3290dda630bcd25df97ee42e66465ba64337dd2586adb621cd973a180f254b72

SHA512
27b1b1f3f53210aa38a3c46f6228b9e64c6527541d09fda01093bfde37275bfe574a6a76549625c6080ff9f866f6affe058f5a95ce765bc4038e5af4c80d0f4f

Download Submit
C:\Users\Admin\AppData\Roaming\020E.3EE

Filesize
600B

MD5
7838f4b39c992c9f870f4a10079b9a27

SHA1
65dd11a21efae4c128d0bc0e380bd0b71020b358

SHA256
34641937b67fb882bd6ab3b756e72963b3d7e148512bc3d274ef3de8e8491edd

SHA512
2cfceea9203755b3b204ff390b9ffba47c7fc27349c7415a17d8fc338899adf17d2f55b1cd51979e8451c925973b4492626bd6bf792cb4f54fefd1f5d38a0e78

Download Submit
C:\Users\Admin\AppData\Roaming\020E.3EE

Filesize
996B

MD5
b17a14a861c64939336ab8a6c35efe61

SHA1
1633e406f9bfdf03cf493c916410a40e2546f608

SHA256
08a0b81a88c3fcf613a59652766aad0ebe583528fbfd2008e29ee5f095c6fd72

SHA512
6bc438355a093c75e7476d5969aaab38869ed00f4a6e1c39fbd1c6f15090ed1097733b6bbd7fc7b6546491d7074fff51928f80002eae5145828572b586cbfc15

Download Submit
memory/664-78-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/664-77-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/664-79-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1592-16-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1592-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1592-138-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1592-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1592-188-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2016-9-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2016-10-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads