cycbot | 1f6967d2b9a8ae24f5d8a44bd0c937b969eacb043a63986c45d599dc4d5ddfb8

General

Target

JaffaCakes118_0624ab543750b24a452d8564426a368a.exe
Size

276KB
MD5

0624ab543750b24a452d8564426a368a
SHA1

0f1e32bd73713397604bce6dbcc130e4391b1888
SHA256

1f6967d2b9a8ae24f5d8a44bd0c937b969eacb043a63986c45d599dc4d5ddfb8
SHA512

e25e441691a46af6c2b047e531e4bea71e28af5446219fb5b58b3723c14782ceca31107665b5d4caf87167b7000a3a800343314b7f2443e4cb3d65cfb6290be7
SSDEEP

6144:IhfAIAwdWYVPNQhxGe6AR4KWyZxeuedVMzjd5lI5IAs0lkF5ebS:pIRdBPqzX4sj5yyzjdPSIV0l25

Score

10^/10

cycbot pony backdoor credential_access discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2944-14-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/1732-15-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/1732-80-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/268-84-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/268-83-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/1732-159-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/1732-164-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\1DAC3\\58ED3.exe"	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe

Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 1 IoCs

pid	Process
952	59C4.tmp

Loads dropped DLL 2 IoCs

pid	Process
1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe
1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-3-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2944-14-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2944-12-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/1732-15-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/1732-80-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/268-84-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/268-83-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/1732-159-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/1732-164-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\D3A1\59C4.tmp	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59C4.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2944	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	31
PID 1732 wrote to memory of 2944	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	31
PID 1732 wrote to memory of 2944	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	31
PID 1732 wrote to memory of 2944	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	31
PID 1732 wrote to memory of 268	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	33
PID 1732 wrote to memory of 268	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	33
PID 1732 wrote to memory of 268	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	33
PID 1732 wrote to memory of 268	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	33
PID 1732 wrote to memory of 952	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	34
PID 1732 wrote to memory of 952	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	34
PID 1732 wrote to memory of 952	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	34
PID 1732 wrote to memory of 952	1732	JaffaCakes118_0624ab543750b24a452d8564426a368a.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0624ab543750b24a452d8564426a368a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0624ab543750b24a452d8564426a368a.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0624ab543750b24a452d8564426a368a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0624ab543750b24a452d8564426a368a.exe startC:\Program Files (x86)\Internet Explorer\D3A1\8C0.exe%C:\Program Files (x86)\Internet Explorer\D3A1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0624ab543750b24a452d8564426a368a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0624ab543750b24a452d8564426a368a.exe startC:\Program Files (x86)\C3456\lvvm.exe%C:\Program Files (x86)\C3456
  2⤵
  - System Location Discovery: System Language Discovery
  PID:268
- C:\Program Files (x86)\Internet Explorer\D3A1\59C4.tmp
  "C:\Program Files (x86)\Internet Explorer\D3A1\59C4.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1DAC3\3456.DAC

Filesize
1KB

MD5
9e35500ba25c10bfc468382be97daad4

SHA1
b1fd72245d042a5c974b6935030410df9fae8853

SHA256
8d0eb080436aef574011e611e661b0f1a7804da0d8926d3f6561065b9c67bc1f

SHA512
2b861080c00b3e321ff65e610128494f08e6d5168ff40ce411736a03173a6753d88ca7f15a91b5dc4e90778efe45e3d1fbaaf6101c1612bc65f9bdb97efc7965

Download Submit
C:\Users\Admin\AppData\Roaming\1DAC3\3456.DAC

Filesize
600B

MD5
c656d62b1cca9ae6814927d660823112

SHA1
5c5f99e921d9eba288755822c114b9b31520444c

SHA256
35138fec2e73c0bd23b46278b27c6d15a7e0447ea515b714df4bbacb9516662a

SHA512
5db139a5346a8b04b701d40788ce2a6796e36b7654738fbac70569d917cd7f65753c82f08baf45d8908e7d28e21edffc697df52b37ccb4a4f5a2722ce31aa0ab

Download Submit
C:\Users\Admin\AppData\Roaming\1DAC3\3456.DAC

Filesize
996B

MD5
25b75e85da0affdbe24f829015ce8799

SHA1
936215949be701024c0d7c9a46d75c152fed9346

SHA256
6cefad92a1288cd53b1c591cf012fd69544267edd4bccbfc26a83346be319bd7

SHA512
71f2f0661862bb1f142c0ebdc978d20124f7867f63e5c1efef0b079fd568fb945644421d943167f61e2245f82ab856af1b1d145d3e653140c41a56d69d22cc17

Download Submit
\Program Files (x86)\Internet Explorer\D3A1\59C4.tmp

Filesize
102KB

MD5
98983d9e6d149afd05c73f9fc444f4a9

SHA1
249cb0c59c29e0ae8940ce6928cb7e6a1d0e5bb9

SHA256
84a1c17937e04bd5090897594950e1aef33acfbbbd675fc7e319d000dfb3110a

SHA512
d94ac1f1b118ae5779458392b31375b064894807e0fc6a3fb9cbc67fb8897ba591054235bf6b52dfd21dd964bb3fe6449bfc6049ccb5466046bfe95361d33fbb

Download Submit
memory/268-84-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/268-82-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/268-83-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/952-160-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/952-161-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1732-80-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1732-15-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1732-1-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1732-159-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1732-164-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1732-3-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2944-12-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2944-14-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads