cycbot | 2903bc0712af918391f81c64d2b6af36479979043aa487c91d0786a6eace9142

General

Target

JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
Size

276KB
MD5

0ec4d8770f84e5be90f352e0910625bd
SHA1

4cec9a115c523d01fd75efb463dd8dae459c61bb
SHA256

2903bc0712af918391f81c64d2b6af36479979043aa487c91d0786a6eace9142
SHA512

f9e59f9f87cadb54d1882ae1e2c196007e13f00319d1cc01d2e6ce9e30e58e65f25596a71b3be611e23ce4c38014aeea14d9a998e9dbf67be6344606f4f93eea
SSDEEP

6144:FxVdGcywMRU9n7WKccpZQoYeGvdgLE6791I9NQdku:FxVdcbOR7WK7jB2Sf7918NQ

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4320-13-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral2/memory/3932-14-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral2/memory/3932-79-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral2/memory/2024-83-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral2/memory/3932-185-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot
behavioral2/memory/3932-188-0x0000000000400000-0x00000000004A9000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\AA5B1\\EFED3.exe"	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe

Executes dropped EXE 1 IoCs

pid	Process
2332	54A.tmp

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3932-2-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/4320-12-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/4320-13-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/3932-14-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/3932-79-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/2024-81-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/2024-83-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/3932-185-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/3932-188-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\D3AA\54A.tmp	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4872	2332	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54A.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4320	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	83
PID 3932 wrote to memory of 4320	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	83
PID 3932 wrote to memory of 4320	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	83
PID 3932 wrote to memory of 2024	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	92
PID 3932 wrote to memory of 2024	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	92
PID 3932 wrote to memory of 2024	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	92
PID 3932 wrote to memory of 2332	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	99
PID 3932 wrote to memory of 2332	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	99
PID 3932 wrote to memory of 2332	3932	JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe	99

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe startC:\Program Files (x86)\Internet Explorer\D3AA\A37.exe%C:\Program Files (x86)\Internet Explorer\D3AA
  2⤵
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ec4d8770f84e5be90f352e0910625bd.exe startC:\Program Files (x86)\B1672\lvvm.exe%C:\Program Files (x86)\B1672
  2⤵
  PID:2024
- C:\Program Files (x86)\Internet Explorer\D3AA\54A.tmp
  "C:\Program Files (x86)\Internet Explorer\D3AA\54A.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 336
    3⤵
    - Program crash
    PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2332 -ip 2332
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\D3AA\54A.tmp

Filesize
102KB

MD5
98983d9e6d149afd05c73f9fc444f4a9

SHA1
249cb0c59c29e0ae8940ce6928cb7e6a1d0e5bb9

SHA256
84a1c17937e04bd5090897594950e1aef33acfbbbd675fc7e319d000dfb3110a

SHA512
d94ac1f1b118ae5779458392b31375b064894807e0fc6a3fb9cbc67fb8897ba591054235bf6b52dfd21dd964bb3fe6449bfc6049ccb5466046bfe95361d33fbb

Download Submit
C:\Users\Admin\AppData\Roaming\AA5B1\1672.A5B

Filesize
1KB

MD5
457deff5eb5ea6d4fe3a197b5b28ff11

SHA1
d609900f1b199a7f8637dbac93c4009e002db68a

SHA256
8440dd850f650727a4833fa5ffffd796064494bcf40aac1d8d29ef8a8c7ffbe6

SHA512
0c8f06ff68c2ceb2ea2f5fbfe7f50c954489e6dcaf89c71ce81d6aec5badb99de939ce066dc04edad56450d1b6cfbb9251b330ad0944263204c0388a4b2c3bb6

Download Submit
C:\Users\Admin\AppData\Roaming\AA5B1\1672.A5B

Filesize
600B

MD5
a8ee6e5cd3ade8f4c29829d6ae75dfb9

SHA1
c254ea6762cf8f311ca79d51dfd63ab2ca3d5bf0

SHA256
69968e5a942cb3414ddc4b7de6a4be0fcd0903e8fb59e2ce0ec82bf9eee4ac00

SHA512
f84cfc74977703f8544141803ad0985f1f0e8d6f961e68832af7689acb040b38aeff6d3043e6640179d1f88a4c02ecb89397e3131fd6e2a8fec6772229dc2d64

Download Submit
C:\Users\Admin\AppData\Roaming\AA5B1\1672.A5B

Filesize
996B

MD5
dfbe2b568e894971a4caa9210aef073f

SHA1
b7a58d933c73d213aa51531c79c91179ee1df9bd

SHA256
ac9db3ae56683b6786e14f985cb0d4527718acdc4be5a02e00744577678f4f2a

SHA512
720f2e3eabea1a4de9493b6daa19df6628d2aa07b69470ae990f0c8dac25a364006454b430468547220a03348346ef1e19b36238da9be824293519b9bfccc49e

Download Submit
memory/2024-81-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2024-83-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3932-79-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3932-1-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3932-14-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3932-2-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3932-185-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3932-188-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4320-13-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4320-12-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads