cycbot | 1d9011525891ae7b3d4d93fefece72e4db3d472dd479d95a896f04a355faeff3

General

Target

JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe
Size

174KB
MD5

09f0b3a451ae967a9f7001f333e61775
SHA1

72ad8b7f2d1d3abb2e8d27c7614eabaeadae5779
SHA256

1d9011525891ae7b3d4d93fefece72e4db3d472dd479d95a896f04a355faeff3
SHA512

b450fe590695097944944a46e2d11bebbcd4404b827205b8e7bdb0107d3fd9b7570de83205975d56491559a4883d63446947a522e0bcf383b954a122e4ddcaf4
SSDEEP

3072:fW0ZO/QFNGawwTXMdqC/XdV1fqc1MxfGZnC4FABexVQZ1s9/cbU:fW0ZpFE9UXKDLi+NCsViu9/u

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2760-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2760-14-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2092-16-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1580-83-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1580-82-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2092-148-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2092-189-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2092-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2760-12-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2760-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2760-14-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2092-16-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2760-78-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1580-83-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1580-82-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2092-148-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2092-189-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2760	2092	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe	28
PID 2092 wrote to memory of 2760	2092	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe	28
PID 2092 wrote to memory of 2760	2092	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe	28
PID 2092 wrote to memory of 2760	2092	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe	28
PID 2092 wrote to memory of 1580	2092	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe	30
PID 2092 wrote to memory of 1580	2092	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe	30
PID 2092 wrote to memory of 1580	2092	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe	30
PID 2092 wrote to memory of 1580	2092	JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09f0b3a451ae967a9f7001f333e61775.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\17BA.6CA

Filesize
1KB

MD5
8e44ed9068593ffaae9144b20def9687

SHA1
7ea2c37ed832dc393a03586b0074a835fca6b824

SHA256
e7dad52a75da634f30c0d80355877132677af497b77607b51e2ce895bb0bff3e

SHA512
deb9fac3b6f1b2c496795aed7dd17b44b9e331635ff7551916a0d73bcad753219de73120c1047c40192c4c6002d249b632ce1d9c7a68fc9460a64b6755efa8a9

Download Submit
C:\Users\Admin\AppData\Roaming\17BA.6CA

Filesize
600B

MD5
684cf683f7743bed64243d35184c95e3

SHA1
587c18203d05e7fb1ccb076d1aad36330d1ed32f

SHA256
9b9e509c3e5bbae5bafa1f5a43fb3878ab1e0d53a4673e3d6db3fac016360376

SHA512
d281072bda47da8b0b43cc0244888bfcfa5cb67a9e5d5eee563931de6efa0a4982565b130558e9f4ad002ada19253a97c3890525a7f557d2fd2131bc8ccc3826

Download Submit
C:\Users\Admin\AppData\Roaming\17BA.6CA

Filesize
996B

MD5
d426b8b1ae4cd4b283226fbbf02130c5

SHA1
b9df314231b7e6b437691dce154b896091544f1c

SHA256
ed547e5dae09489bb3904a794373e608ece19cceddfcebaf8567863cabce0f12

SHA512
dac83a298ce26cb865c2430bb47c8bb592e2e9c65f3f5059a922d39f4f438d22cf67b715424ded1c25b50d2a4aaae151b251410147c404f25f4b106c944b6f28

Download Submit
memory/1580-80-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1580-83-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1580-82-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2092-16-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2092-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2092-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2092-148-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2092-189-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2760-14-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2760-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2760-78-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2760-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads