cycbot | ae83c5be037577cfecc84e6c98bbe97a867fb2c648f831cc3c6d3633c3c2cec1

General

Target

JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe
Size

155KB
MD5

0dd6b19a7ef9f56398f5cb3c703e035f
SHA1

6f4cfc9cc5273d6e9460cfa3eac890026ac5e89a
SHA256

ae83c5be037577cfecc84e6c98bbe97a867fb2c648f831cc3c6d3633c3c2cec1
SHA512

5da0941b25b8fe9e2eb23d4dcf572bd7730b0d7e9abdc88be9d11f25e88d0685371fc26fb569b7708a35ca6327c177e3bf5ae2c81162590be15ff19365d99b9b
SSDEEP

3072:/5YVCJkl1Af507pT20o1sP2FR4JCi8o0BmM6JBpaSg0d2FOoYj2XFo7J:eVnlo1sP2UgicmHIn0dmAj4y

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2808-6-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2704-14-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2704-81-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2908-83-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2704-152-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2704-189-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2704-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2808-5-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2808-6-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2704-14-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2704-81-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2908-83-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2704-152-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2704-189-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2808	2704	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe	30
PID 2704 wrote to memory of 2808	2704	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe	30
PID 2704 wrote to memory of 2808	2704	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe	30
PID 2704 wrote to memory of 2808	2704	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe	30
PID 2704 wrote to memory of 2908	2704	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe	32
PID 2704 wrote to memory of 2908	2704	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe	32
PID 2704 wrote to memory of 2908	2704	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe	32
PID 2704 wrote to memory of 2908	2704	JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2808
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0dd6b19a7ef9f56398f5cb3c703e035f.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0360.147

Filesize
1KB

MD5
62f41ee7278df63ceaca1a468b167803

SHA1
b5d99dde33881c63ed3d9aaf2920a87d9f3729ee

SHA256
790decde98c48c42ec35f21aab5efa5c71d7f87b599e0577716dedd2c587ef4b

SHA512
909a5200c4bd68e8d2c128988e62ddac4793d2b5fcac22fc8bc97085c4ec47df85317513bb18111c7781d5b052f8d56b7047fe99dbc71a9213c2213c448ce96a

Download Submit
C:\Users\Admin\AppData\Roaming\0360.147

Filesize
600B

MD5
ed201f9c30433b53388804fdfac27d70

SHA1
7b74370624bb1e943820dad804449b030e04df3a

SHA256
c321edb6f7e6b5841bfb04f8fb898b24ad1613d1804d495d1761964799e10a9e

SHA512
8290e0c569adfafb97298001bae9e4244f3ea35f33f88324a27000c32eecc8a95ab46539a987e16f9f9ca917c96f74c1f1ca0f8d4951ef34b00b7eb88c59bac2

Download Submit
C:\Users\Admin\AppData\Roaming\0360.147

Filesize
996B

MD5
cd0ffef2d4fd65fd76e3c15b231f6985

SHA1
8741838877b951161b218c9a70b577ffa8016ea3

SHA256
d7c723176ca5fddc00aabe5fca1f923e7702925365b903d76bdc7eb664aaad4e

SHA512
cd9c0f46f21e033b4ed2bd05b1f3a324a955883455e1733b68d85741d8c3c637d4c41cdb6ae1c3e71f04fe9b7a51f5b17ad638757e6023affeedbee87f58ad30

Download Submit
memory/2704-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-81-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-152-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-189-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2808-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2808-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2908-83-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads