cycbot | 4cd4548a746886716533c93209467c8b5e5a143b136bd690fbdd8c8eeab8559c

General

Target

JaffaCakes118_1613319be3944ad8a491ba247988950e.exe
Size

165KB
MD5

1613319be3944ad8a491ba247988950e
SHA1

f20fab2b47a47bc406262d1fe94eebbeaa3f9fea
SHA256

4cd4548a746886716533c93209467c8b5e5a143b136bd690fbdd8c8eeab8559c
SHA512

994d90172640d4c27326b8bc0f6531799d1a2ec03cef328df28f25b96f4389880d8ae05b3855038aed75dee0eff650865c95cc44f409468c96afa4ded37c9499
SSDEEP

3072:/IfhQdQrUqok5ZEo0/75HouwFoLs53cxibWS1IZgd52P8YIv+zSZO:AfcN/eE/D5HI5sxiJIcOjhzr

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2724-8-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2412-16-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2412-81-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/340-85-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2412-201-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2412-2-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2724-6-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2724-8-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2724-5-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2412-16-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2412-81-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/340-84-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/340-85-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2412-201-0x0000000000400000-0x000000000048A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2724	2412	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe	31
PID 2412 wrote to memory of 2724	2412	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe	31
PID 2412 wrote to memory of 2724	2412	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe	31
PID 2412 wrote to memory of 2724	2412	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe	31
PID 2412 wrote to memory of 340	2412	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe	33
PID 2412 wrote to memory of 340	2412	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe	33
PID 2412 wrote to memory of 340	2412	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe	33
PID 2412 wrote to memory of 340	2412	JaffaCakes118_1613319be3944ad8a491ba247988950e.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1613319be3944ad8a491ba247988950e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1613319be3944ad8a491ba247988950e.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1613319be3944ad8a491ba247988950e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1613319be3944ad8a491ba247988950e.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1613319be3944ad8a491ba247988950e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1613319be3944ad8a491ba247988950e.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\17F8.D34

Filesize
1KB

MD5
4ee32745d613a6916d9e1dae8f921966

SHA1
74e6ccca91a8118bf17ab2ed8c5b563797be6ac8

SHA256
d6e704e9a8432adf62564d7d54e9ecf5ec6151f0dd0d9401c5d2fe12572ee25b

SHA512
376ac3df02d9f96532cf7bd5ea06cb1579f523b6ed7fc2d3f17e60fa9d56e205a43dcdfa0d52a4284fa058384292de1af9cb106bb8771449028f39fa64756065

Download Submit
C:\Users\Admin\AppData\Roaming\17F8.D34

Filesize
600B

MD5
febe5825b0f38b698949e8339df2ebeb

SHA1
f65893532b8798a100683b698e5d607c6a41040f

SHA256
9841c385ef96da56aa66316f4ae8f11c8dd8edb3f28f476c5477c56cd2a816a6

SHA512
03d68fb422753c8cf1ae771b006a742b15c554587e18c8061a8c8e5c41dfb5911cc8c3c0dca6cfbb9cfe01692bb6517b3409405a7e8f5c0db282b27b18c7436b

Download Submit
C:\Users\Admin\AppData\Roaming\17F8.D34

Filesize
996B

MD5
70a9ffe66fefdd5b77622bfdde72a6ba

SHA1
8af2778de7377612a787ea6c8c048778334f8cc0

SHA256
3141037a6e1fb10074c4c4f704394762ee186153de146657464c841601f51ec5

SHA512
f018bc3c374bc35d262b8116cd0f9f9c05e8d9d1f71060fb90169614cc2549356a65a048a5e8de5d3f936d32c3817f3a3b4dc01ff3cd18f7647afcca93a22420

Download Submit
memory/340-83-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/340-84-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/340-85-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2412-16-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2412-81-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2412-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2412-2-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2412-201-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2724-5-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2724-8-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2724-6-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads