cycbot | b9a3dfc84f175df261cea1f38830a476dbf290573ce4f363d78c76afa1759a24

General

Target

JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe
Size

167KB
MD5

7a7bb93bce111aca14143890b812fed4
SHA1

4c2861efdf32de91c29015690a67c96e746d13e6
SHA256

b9a3dfc84f175df261cea1f38830a476dbf290573ce4f363d78c76afa1759a24
SHA512

f99255b98cd286ed8c2dcc62d2d18154ef7c4467ab923c05c32ed1a2121f2f4b5143cd882599767c80611621aa67e00fc18687cac08ca01231674bc394897ad6
SSDEEP

3072:qZDtpSLETxfdEH3qxyXSGMCa6IXWThRsZz6K/Hqm0v:kWCfdAqxyiGMBGhRtgHJm

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2516-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1816-20-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2924-90-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1816-143-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1816-187-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1816-1-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2516-13-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2516-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1816-20-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2924-88-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2924-90-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1816-143-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1816-187-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2516	1816	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe	30
PID 1816 wrote to memory of 2516	1816	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe	30
PID 1816 wrote to memory of 2516	1816	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe	30
PID 1816 wrote to memory of 2516	1816	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe	30
PID 1816 wrote to memory of 2924	1816	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe	33
PID 1816 wrote to memory of 2924	1816	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe	33
PID 1816 wrote to memory of 2924	1816	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe	33
PID 1816 wrote to memory of 2924	1816	JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a7bb93bce111aca14143890b812fed4.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D573.062

Filesize
1KB

MD5
4659103bd27341fabb58e63e759e5368

SHA1
114e476fcb30f2dabfcc70c8f3d3508490b1da79

SHA256
d87b9d9401b056153c5cba52d9aaf9c98e897e7d1a9f1222c755b2cdfe1deb78

SHA512
a046824646fdb88438ca1eaedfbfa51647de512a3d572c998a9ec174ce2f3931027bc7b01a909eceed0b78e660278aaf23decc2cbbe38b207090d01f88b86db5

Download Submit
C:\Users\Admin\AppData\Roaming\D573.062

Filesize
897B

MD5
e62509febf80c1d7ac11776e4f47ccd0

SHA1
65b31ec4fdef589451bf85d3b679d57de8486c81

SHA256
41281e0c3c19cd92898cf1a2d19fbf8737925311d8958b81f633c835875c3176

SHA512
feb4d12a87a35ab8a9b2ef854b9627f5ef505c67fbad7cde6d89aa21f9146c776d16079d014b7e0e5ca77b6ae595c6e882eb45e2a1c1e1bbb107089998f40177

Download Submit
C:\Users\Admin\AppData\Roaming\D573.062

Filesize
597B

MD5
9a362724ee39573caa131a0a23d14f14

SHA1
ae9bd9e9e734eaa576e85931eadc54c07cba7b02

SHA256
21a04a874ad399464bca81123f197d6340e555cc5e45665268fd416813c52449

SHA512
3ad8da0701e211f4be195b979ee6000d392bc5070bc804d0540106ec6b68020b59b5ab2416a5dec87c6615cf83aad23a3757ee1978d797ce6a4a8b52c34a433c

Download Submit
C:\Users\Admin\AppData\Roaming\D573.062

Filesize
1KB

MD5
14dacd722e76a0fe80eeb9a2e0c60eef

SHA1
1fc631819f0c844ca59f8058d89b345a4753562f

SHA256
eb1f142966aa6b11cb60d7303dee466885c19983f00656f8a04e65dfe988f74f

SHA512
baf9558abbe172207cb1c38cec56f96880558656b5ec09a089f5e3a5bf10ebfeb8ffe535a471db0893270de6989352c32aab9a6cb5e0b764061633414dfa6864

Download Submit
memory/1816-20-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1816-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1816-143-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1816-187-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2516-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2516-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2516-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2924-88-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2924-90-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads