cycbot | 4c0a068a433397c579cafa1ec221622d0168daed98ee4b61514c46bcdac3f942

General

Target

JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe
Size

171KB
MD5

11f7c6e7363a4ae04e94413cab5841e7
SHA1

96ce6b0878f37162df0266773154e8c7bdde1179
SHA256

4c0a068a433397c579cafa1ec221622d0168daed98ee4b61514c46bcdac3f942
SHA512

a92a51232e7f682bd808de0a7ac84fbc7bd7f510249067ee138ce4d803815f3e69dd64fdffd6e3180ecb4e461e036d23551c5067aaa418e596c065f4719d9125
SSDEEP

3072:kJWkNI8PM+RaFCD8Im7lVkl/I286gGpZaiOnuYalaY+bQuQwO1i0S2Zw6ykqKtH:S/XM+RwKZm7lVklw6gCZaJfa4YeQp7Mp

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2576-15-0x0000000000400000-0x00000000004A2000-memory.dmp	family_cycbot
behavioral1/memory/532-16-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/532-17-0x0000000000400000-0x00000000004A2000-memory.dmp	family_cycbot
behavioral1/memory/2576-18-0x0000000000400000-0x00000000004A2000-memory.dmp	family_cycbot
behavioral1/memory/532-81-0x0000000000400000-0x00000000004A2000-memory.dmp	family_cycbot
behavioral1/memory/3032-85-0x0000000000400000-0x00000000004A2000-memory.dmp	family_cycbot
behavioral1/memory/532-182-0x0000000000400000-0x00000000004A2000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\A4E4B\\914AD.exe"	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/532-3-0x0000000000400000-0x00000000004A2000-memory.dmp	upx
behavioral1/memory/2576-15-0x0000000000400000-0x00000000004A2000-memory.dmp	upx
behavioral1/memory/532-16-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/532-17-0x0000000000400000-0x00000000004A2000-memory.dmp	upx
behavioral1/memory/2576-18-0x0000000000400000-0x00000000004A2000-memory.dmp	upx
behavioral1/memory/532-81-0x0000000000400000-0x00000000004A2000-memory.dmp	upx
behavioral1/memory/3032-83-0x0000000000400000-0x00000000004A2000-memory.dmp	upx
behavioral1/memory/3032-85-0x0000000000400000-0x00000000004A2000-memory.dmp	upx
behavioral1/memory/532-182-0x0000000000400000-0x00000000004A2000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2576	532	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe	31
PID 532 wrote to memory of 2576	532	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe	31
PID 532 wrote to memory of 2576	532	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe	31
PID 532 wrote to memory of 2576	532	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe	31
PID 532 wrote to memory of 3032	532	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe	33
PID 532 wrote to memory of 3032	532	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe	33
PID 532 wrote to memory of 3032	532	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe	33
PID 532 wrote to memory of 3032	532	JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:532
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe startC:\Program Files (x86)\LP\AD0A\F20.exe%C:\Program Files (x86)\LP\AD0A
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11f7c6e7363a4ae04e94413cab5841e7.exe startC:\Program Files (x86)\4BFCB\lvvm.exe%C:\Program Files (x86)\4BFCB
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A4E4B\BFCB.4E4

Filesize
1KB

MD5
4a62058358fe36cb929c411bfa290609

SHA1
8c0ca80dcf93ae5ec4a84960fbe65e5da1205755

SHA256
fd1e16f3ae49761f41e49d5f4fab3e38a84d77a017991ed4fe5c42e452dc7f18

SHA512
822455cdb728832b1d3a2a929d7cc7656c12c57960d4a6f34460dba6a7b6568f023a21ee443c5df2b7d562e9c4c984f445603ed40a21c419594e6fe51d528337

Download Submit
C:\Users\Admin\AppData\Roaming\A4E4B\BFCB.4E4

Filesize
600B

MD5
c51b3df2d5b08d5ab25a60bda4d9e19c

SHA1
46b6123f8c3a5e7c2915c4971eac27cc60df3cb2

SHA256
c5073eef9478714fa2a2375c0543eb05d70d32cd75363a194bb88c0276271047

SHA512
bef0d03b0aa81ffe9fbd6cfaa81198194f58b4a71fabce6bcb8df4332cbd531329781a37c8f48c0a7e4bc976130fd1f5674dbfe6337ddf43d8193ba47789410e

Download Submit
C:\Users\Admin\AppData\Roaming\A4E4B\BFCB.4E4

Filesize
996B

MD5
451f0586148279a0803cd0660b6ef0fd

SHA1
172e6103e88dc91dfeb30c06415da976b31818d2

SHA256
f807b9e1343c71433047ab063b02188ae0a9a8f87956bdc160e6ec9cf9e77709

SHA512
e6c61e57ce7563230813674638acc690b1cf9a321c7594026d0d6b682308525ca098e781a394d2636be234232af13361c084f33143c830785ec04d1b623df609

Download Submit
memory/532-81-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/532-16-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/532-17-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/532-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/532-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/532-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/532-182-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2576-15-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2576-18-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2576-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3032-83-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3032-85-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads