cycbot | 4d3dc05ef0cb8509dbbea9dc47d93306d89046faa7eb4ba93b9c762462136f00

General

Target

JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe
Size

184KB
MD5

0c30b7facfade74e515608fdceb2926d
SHA1

2a9ab72f77d63884598cbf5fed63288495752c0e
SHA256

4d3dc05ef0cb8509dbbea9dc47d93306d89046faa7eb4ba93b9c762462136f00
SHA512

f6cdde662069bf9bfef1d5d6755d30ee7db343df9c6eeac6728dc8db1693bb864dfbdbbb039a305a43ee6be6715833d88f1cd7b931dab80a8f30ff0dd0b6d684
SSDEEP

3072:VEy251OtJb46DY8RGx8XOWhXO0uLTCTbJmEjFCViGQDmxYzuS9HineAwaI+:VEy2I46Dbk89hXPXzFka7inV1

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2472-12-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/1084-18-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2608-77-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2608-79-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/1084-80-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/1084-165-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/1084-196-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1084-1-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1084-2-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2472-12-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2472-11-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1084-18-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2608-77-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2608-79-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1084-80-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1084-165-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1084-196-0x0000000000400000-0x0000000000466000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2472	1084	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe	30
PID 1084 wrote to memory of 2472	1084	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe	30
PID 1084 wrote to memory of 2472	1084	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe	30
PID 1084 wrote to memory of 2472	1084	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe	30
PID 1084 wrote to memory of 2608	1084	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe	32
PID 1084 wrote to memory of 2608	1084	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe	32
PID 1084 wrote to memory of 2608	1084	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe	32
PID 1084 wrote to memory of 2608	1084	JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2472
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c30b7facfade74e515608fdceb2926d.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E703.054

Filesize
1KB

MD5
8588b803a47623174f1d35dc617e2349

SHA1
18898f506c01780d39bbf8692a0e416f21639c52

SHA256
0a4e7ec74c1686a501b6207c7cc54855afb5088d901874308697a822e42f7b7e

SHA512
01ebb3530af7012c2d56061306d80f4a5621c2b190aa8a944e690627003c369537fcca882317eb58cb80db026422a68c85c8c6493a41f8de0c2b9af48bea213c

Download Submit
C:\Users\Admin\AppData\Roaming\E703.054

Filesize
897B

MD5
4b56eabc038f3f70d818a7af2c534bbe

SHA1
da69e697f5ec0c848b1bd4d14a62cb409a8bb8a7

SHA256
633e0ff80f28a7da19e3756a36e99dd78de0ee0c326ef4bac674681b4d0226b3

SHA512
50d11a6382e2524aeab4edab437d0b3d3ab0737dbb9a255cf4456dfbb352d268a681a5184e1d63975cc0550d2884969a8ce605e5fbf0bbb44ae352a3e242a66f

Download Submit
C:\Users\Admin\AppData\Roaming\E703.054

Filesize
1KB

MD5
e58f99ff68107ecd7478fcca4477193b

SHA1
0ed6f9f503ecb5d9fc41db7e53a098543820bbb8

SHA256
ea572a28ad45fa497c512c6e4900b6ad3a687d47885df30172c23bdba35024b9

SHA512
903475f418e4b4202055cd9eb426b94077109e0f34a1e97b17ed5b04d4ea42f365e136fafdd93541eb0624b3c4b5b292ca07d875d1f7d1f49eb209b0bee4fb28

Download Submit
C:\Users\Admin\AppData\Roaming\E703.054

Filesize
597B

MD5
27f62b8bd4471ae9b9ee27b9aa102130

SHA1
1b09079eecd002c652f21a41d77fd66bed600471

SHA256
4272dd006e74c202d8507b90e0736541ea9496d6abfd8aafaeed424e39cb1bcb

SHA512
e5bb10da582dbbb1f363dfa27c8815041fcd5b33a3305a7114698f24da9f2fbc0f9a5432d41e61e6986aafd4625465a273b2c51d4e927619d69142dcd242ea49

Download Submit
memory/1084-80-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1084-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1084-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1084-196-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1084-18-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1084-165-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2472-12-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2472-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2608-76-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2608-79-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2608-77-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads