cycbot | af4d383dc2cc23dbc236914a502e4ed3e9e3a721b440888692d1f4a5acd3a6c3

General

Target

JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe
Size

166KB
MD5

11236ae1df0604af02e23d8a45204ae8
SHA1

cbf7a573e9185d47e32e1af0203e60bfc129372d
SHA256

af4d383dc2cc23dbc236914a502e4ed3e9e3a721b440888692d1f4a5acd3a6c3
SHA512

46b0ee6ad2441c710cc39b6eac4387fe268e2cc56e3f6a202740b56164f65b27f85db2a053cd9b5e4536599f4bab8bf174175d09ec0469ed95bc4928f0d4c993
SSDEEP

3072:krAMKLPxuowsyQQhO9IPje8KzfNMkSQKXz0vEy55eGeTBfqe:kr6rxuow31PLe8UfNqPXzy50GeTB

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2788-13-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2788-14-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1680-15-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2532-87-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2532-86-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1680-88-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1680-206-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-2-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2788-12-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2788-13-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2788-14-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1680-15-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2532-87-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2532-86-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1680-88-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1680-206-0x0000000000400000-0x0000000000446000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2788	1680	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe	30
PID 1680 wrote to memory of 2788	1680	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe	30
PID 1680 wrote to memory of 2788	1680	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe	30
PID 1680 wrote to memory of 2788	1680	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe	30
PID 1680 wrote to memory of 2532	1680	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe	32
PID 1680 wrote to memory of 2532	1680	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe	32
PID 1680 wrote to memory of 2532	1680	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe	32
PID 1680 wrote to memory of 2532	1680	JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11236ae1df0604af02e23d8a45204ae8.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0E53.A91

Filesize
1KB

MD5
b879362202e09e8bfed2059bf60a2f9c

SHA1
f5b583071dae4e672b91252aea38fca41afe8e23

SHA256
f95aad4b81adbd81bde25223671f98667c727b379ecdebdcae9da9a69d5bc751

SHA512
f64c3172a6e0132096088d0f31756535ade75e03c4b96b9c8e1662a4e10a3e2b2771abc57a75edf805d676c02a85a0549669bc7d6ff9b443e2aecb49dd248072

Download Submit
C:\Users\Admin\AppData\Roaming\0E53.A91

Filesize
600B

MD5
856d0cd7df8b22a270750d2f372e1640

SHA1
3c55d17c5edbf2df58b6d6550e8b61a8b013d57c

SHA256
67b85275970196282ed493886e797c223ca594180f1c843fce3e9c5b0f80b7fd

SHA512
e16eb28ae8fe5bf12f8d5c80dcc961c8f42f8ea898cfd6fe7adce295414aed71f98bf67b73aee9c1174028d16c86c8b2c2235937e70fcfed7278575dfba6617c

Download Submit
C:\Users\Admin\AppData\Roaming\0E53.A91

Filesize
996B

MD5
127d4bcbadd2082169bc5c8a5e009e4b

SHA1
1a46225d7393d6090388b2dc73c343399a549a6e

SHA256
7a64d261c4785566480a588db81dda58344693946177227e2d8f90aa97cac2aa

SHA512
88340aa2ec9f95a59123a9af709be83428f6be1f0070955c37c9a260c0f1166a83f918b3b9b91e777f4f0b299834bfde5d19db7095270c0a2601eb39d6afe77d

Download Submit
memory/1680-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1680-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1680-206-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1680-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1680-88-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2532-86-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2532-87-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2532-84-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2788-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2788-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2788-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads