cycbot | 2d9dea3233ce4c5221b8d3b98f5ac39966985727f5313a53744b29e9a319254d

General

Target

JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe
Size

184KB
MD5

18c091c6c0e3a31372b0659ff7c14de0
SHA1

55d0e1bfab84de390a0a7ffee0b002d61ccb0cbc
SHA256

2d9dea3233ce4c5221b8d3b98f5ac39966985727f5313a53744b29e9a319254d
SHA512

16bca1d3ca08332fd5c5fd346923ce8ffde817fb689dbe5f6198a4ac7b7c79d6ab6c1c922e05e623e9610dad9e46f28be8cd7b1daf5a23dd8a33eeab48e198d8
SSDEEP

3072:AaUwxEaYBYm7KBelUO9HRbXGiLbrNnwfqHnhexxWeWFigJBJBDdorS:7U/Bj7K32zjbrFg4e6JfR

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2880-8-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2240-14-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2412-75-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2412-77-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2240-78-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2240-155-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2880-8-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2240-14-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2412-75-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2412-77-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2240-78-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2240-155-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2880	2240	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe	30
PID 2240 wrote to memory of 2880	2240	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe	30
PID 2240 wrote to memory of 2880	2240	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe	30
PID 2240 wrote to memory of 2880	2240	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe	30
PID 2240 wrote to memory of 2412	2240	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe	32
PID 2240 wrote to memory of 2412	2240	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe	32
PID 2240 wrote to memory of 2412	2240	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe	32
PID 2240 wrote to memory of 2412	2240	JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_18c091c6c0e3a31372b0659ff7c14de0.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\583F.6AE

Filesize
1KB

MD5
ec151ffd4e87e48f019fb4f6594f003a

SHA1
838574a14a613f56fcb899ad7a8f03c78dccfaa2

SHA256
8d2ecd6782058f00cb4c2a2b9a532d9667f295c78cfb85c49821cedc5b9c105b

SHA512
0547536441670f21d7fc148b504ce6720ce89298eafd7f1d80ffe1f6e8a9b73f4d12a4eecbebd87fab7025358bd9cce355a4aa61ea8812e9def03963a6de9502

Download Submit
C:\Users\Admin\AppData\Roaming\583F.6AE

Filesize
600B

MD5
e17587f0ecbd133c55b34f98826c031c

SHA1
15b41330bcf8943ca8dab615cd5aaf635a8a16ee

SHA256
b3629e288085c92b288c4f63f76f084e631ace9021cb3c2f23613bd3c8345796

SHA512
dec684c7ce9df3e288f427f658b54d3700527d8fc8ab20d53ff041ce2932eeb3d5222ae5de549334b45e90990acf20c84914ba53b6097bd6798cc5d23dae71a5

Download Submit
C:\Users\Admin\AppData\Roaming\583F.6AE

Filesize
996B

MD5
3b8479961d939be23b83c3283e1a96ca

SHA1
35d39feeb5a722b888a0a9d6680ed5ba062a900f

SHA256
b8643f6eb63228631cd3b0995c8fda1b52eea976f3a9a991e770c5e71f106e8d

SHA512
c3f2809c9c3aacc859156d639e0cb1c99025e6fdb06f77c1b2acd4982f4575307996cc301c467f42b3140fd311441aed5e1bdebf37cc4b8bd119610b82ad343a

Download Submit
memory/2240-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2240-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2240-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2240-78-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2240-155-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2412-75-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2412-77-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2412-74-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2880-8-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads