cycbot | 2903bc0712af918391f81c64d2b6af36479979043aa487c91d0786a6eace9142

General

Target

JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
Size

276KB
MD5

0ec4d8770f84e5be90f352e0910625bd
SHA1

4cec9a115c523d01fd75efb463dd8dae459c61bb
SHA256

2903bc0712af918391f81c64d2b6af36479979043aa487c91d0786a6eace9142
SHA512

f9e59f9f87cadb54d1882ae1e2c196007e13f00319d1cc01d2e6ce9e30e58e65f25596a71b3be611e23ce4c38014aeea14d9a998e9dbf67be6344606f4f93eea
SSDEEP

6144:FxVdGcywMRU9n7WKccpZQoYeGvdgLE6791I9NQdku:FxVdcbOR7WK7jB2Sf7918NQ

Score

10^/10

cycbot pony backdoor credential_access discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/844-14-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2128-15-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2128-70-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2672-73-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2128-152-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral1/memory/2128-157-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\A364C\\E6ED3.exe"	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe

Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 1 IoCs

pid	Process
2976	10B3.tmp

Loads dropped DLL 2 IoCs

pid	Process
2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-2-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/844-14-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/844-12-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2128-15-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2128-70-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2672-72-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2672-73-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2128-152-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2128-157-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\D3AA\10B3.tmp	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10B3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 844	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	30
PID 2128 wrote to memory of 844	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	30
PID 2128 wrote to memory of 844	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	30
PID 2128 wrote to memory of 844	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	30
PID 2128 wrote to memory of 2672	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	32
PID 2128 wrote to memory of 2672	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	32
PID 2128 wrote to memory of 2672	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	32
PID 2128 wrote to memory of 2672	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	32
PID 2128 wrote to memory of 2976	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	34
PID 2128 wrote to memory of 2976	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	34
PID 2128 wrote to memory of 2976	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	34
PID 2128 wrote to memory of 2976	2128	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe startC:\Program Files (x86)\Internet Explorer\D3AA\508.exe%C:\Program Files (x86)\Internet Explorer\D3AA
  2⤵
  - System Location Discovery: System Language Discovery
  PID:844
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe startC:\Program Files (x86)\4C991\lvvm.exe%C:\Program Files (x86)\4C991
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Program Files (x86)\Internet Explorer\D3AA\10B3.tmp
  "C:\Program Files (x86)\Internet Explorer\D3AA\10B3.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A364C\C991.364

Filesize
1KB

MD5
642d67bf05f1a7cc5868d9bb327956ec

SHA1
f1b2f03cdc79cc9738e53b32f7603cc2898fd4f4

SHA256
519ece01537fbda1ce2f79bc132060ec829d861cf03d122b4b8b46f46c27591e

SHA512
97b4a7facfab4364296bc5971b7a5be7da3f7370729d875a74be279a7f62ea53a860a2c2d28eb05333d65fcdce0abde2c7f5aa611831c6e63730de4c83cd85a5

Download Submit
C:\Users\Admin\AppData\Roaming\A364C\C991.364

Filesize
600B

MD5
5331fbe400129f8763615d2dccb4c357

SHA1
b61af79f707c347895db97c26fb7ac2dd60a9fb7

SHA256
32326395c3c9d7d03b5601aa03fbc4e33799b050f7a6cb8cc6b6882f8c661c86

SHA512
65b432d08545e0bff1b64d7700f39328c4ba42f8aa789155bc7f05036f00304ba9e2897ef5ff167239cac2f06e50f5e1ec4032bdbcc9093c3d078a781f65109f

Download Submit
C:\Users\Admin\AppData\Roaming\A364C\C991.364

Filesize
996B

MD5
4dffa5b7f44dc497840c614cd002b2a6

SHA1
5a6e6cd778864ba198e339203a0506a3f39cd8a7

SHA256
be6cf90af656e1adb5a1cfcba503cfca0da8d175106914e7ce5704b1ae468cea

SHA512
1d6ca9ee0eb387b3d52df2acc2e616333546f2860508125b3f50a2f5e16eee8b34e98ff452363e56b0fb5a2585c926c360bdb106c02a483560cde8ce23e4870e

Download Submit
\Program Files (x86)\Internet Explorer\D3AA\10B3.tmp

Filesize
102KB

MD5
98983d9e6d149afd05c73f9fc444f4a9

SHA1
249cb0c59c29e0ae8940ce6928cb7e6a1d0e5bb9

SHA256
84a1c17937e04bd5090897594950e1aef33acfbbbd675fc7e319d000dfb3110a

SHA512
d94ac1f1b118ae5779458392b31375b064894807e0fc6a3fb9cbc67fb8897ba591054235bf6b52dfd21dd964bb3fe6449bfc6049ccb5466046bfe95361d33fbb

Download Submit
memory/844-14-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/844-12-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2128-157-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2128-1-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2128-15-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2128-70-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2128-2-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2128-152-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2672-73-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2672-72-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2976-154-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2976-153-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads