cycbot | 1c97d2a1eceae2103ae91b9e7843f293d35197b447a7f785913bd63b967449b5

General

Target

JaffaCakes118_1949203e6d457420287be590d762e60b.exe
Size

193KB
MD5

1949203e6d457420287be590d762e60b
SHA1

0e55bfb2db400591f77b81715cd922aafce0c061
SHA256

1c97d2a1eceae2103ae91b9e7843f293d35197b447a7f785913bd63b967449b5
SHA512

3f340a6761d40c3b80f9e79a5ac873b44623f4d692c0c921bc8f46e47d4471a2820d44b9d5b3be72281c4a8fb3e14ce25dec6e56df3bab667911e4b5b26ce57a
SSDEEP

6144:o4EmD56e1xBvEkbLGcAzpMVR2dulRXWJO:MoB8ArR4oln

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2792-14-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2120-15-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2120-72-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2208-75-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2120-185-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_1949203e6d457420287be590d762e60b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-2-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2792-13-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2792-14-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2120-15-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2120-72-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2208-74-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2208-75-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2120-185-0x0000000000400000-0x0000000000470000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1949203e6d457420287be590d762e60b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2792	2120	JaffaCakes118_1949203e6d457420287be590d762e60b.exe	30
PID 2120 wrote to memory of 2792	2120	JaffaCakes118_1949203e6d457420287be590d762e60b.exe	30
PID 2120 wrote to memory of 2792	2120	JaffaCakes118_1949203e6d457420287be590d762e60b.exe	30
PID 2120 wrote to memory of 2792	2120	JaffaCakes118_1949203e6d457420287be590d762e60b.exe	30
PID 2120 wrote to memory of 2208	2120	JaffaCakes118_1949203e6d457420287be590d762e60b.exe	32
PID 2120 wrote to memory of 2208	2120	JaffaCakes118_1949203e6d457420287be590d762e60b.exe	32
PID 2120 wrote to memory of 2208	2120	JaffaCakes118_1949203e6d457420287be590d762e60b.exe	32
PID 2120 wrote to memory of 2208	2120	JaffaCakes118_1949203e6d457420287be590d762e60b.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1949203e6d457420287be590d762e60b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1949203e6d457420287be590d762e60b.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1949203e6d457420287be590d762e60b.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1949203e6d457420287be590d762e60b.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1949203e6d457420287be590d762e60b.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1949203e6d457420287be590d762e60b.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\41C4.F5A

Filesize
1KB

MD5
c6058181334feb16af7b190b88cdfe2f

SHA1
c952ae29a0747b653bd04fa2324fa79e2a53062c

SHA256
d6260e9d053d105c790979ef977f7d0c99b3fd04d722aa9bbaeecdaeaccd473e

SHA512
b9587d19e072be505d68e219fd05d4d065572ff2f5e2f4e62d0fff7646a2a6fc96e3d6b6124a3f6ca2cb9390ed3693bcd53c9d564e7134cf7a9ff5af76405468

Download Submit
C:\Users\Admin\AppData\Roaming\41C4.F5A

Filesize
1KB

MD5
ec0c1a3a350878d46a312b7896891a48

SHA1
9cb14803cdcf1d82707cb25505e9b997aabc50db

SHA256
17b7eb488f6943c56aed151a7bc159e37b814d41e499b86846f3b0d9286da1ef

SHA512
d6aca2d93d1d594f7b2a2accac09706f79a733367d86f7a0e1fc25f81d3415c12aff0a4d506c86915e84a7da6d4d6432852aed0f9dc00eaedec9e96e64ce6359

Download Submit
C:\Users\Admin\AppData\Roaming\41C4.F5A

Filesize
600B

MD5
39906f92aeb275d421fe85e4da1ac2b1

SHA1
7a125d643139d81b32170080f2e9df46bd21ae70

SHA256
90d16613ce8ca04740a120a614f5ed3cdbdf4ba60fa7533e73b5df1598f77c38

SHA512
a9a042c3e284cda9b088611e48bd9ce0b735de594cedae250bdd13632652d51068bd06833ce89400a6d5f6b98c8559006b67ad0dc3a1a69aef4edb1623b1a48a

Download Submit
C:\Users\Admin\AppData\Roaming\41C4.F5A

Filesize
996B

MD5
05c7f472309610acd6c4c381c28ee2d2

SHA1
7e8a0aa7ee6a995b0fdf8213fe220b4817bc7e43

SHA256
226ec9f56dc14a5c236714583fef63c727197ef8812309a6fb6317838d72c4b7

SHA512
6f977e2ae422760daeb68605205eb0da38d38c0df9b4b6ce4efc549cc1978ec8bedbd9e0550ad070cb54941442b15e08f70fe3fb80bc44253022f898c14fe879

Download Submit
memory/2120-1-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2120-2-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2120-185-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2120-15-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2120-72-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2208-75-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2208-74-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2792-14-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2792-13-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2792-12-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads