cycbot | ade0e5801f4ff308ee39d0fbfdb34bf17805e793ed15cba7d316edea41867d82

General

Target

JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
Size

164KB
MD5

1eb92c6a918c7f5bdce6dfdafe6b8411
SHA1

2bda89cf5871ae9a62f7b3c575c1ae9dfb33fc59
SHA256

ade0e5801f4ff308ee39d0fbfdb34bf17805e793ed15cba7d316edea41867d82
SHA512

f3c4a87f9e12be454532de5da460b356b21e8a385ac6480976d05981c738bb40a862ed38e502d78d8175fa2f7fbba43c97c96f5984818537703354bb3056be0b
SSDEEP

3072:CWq4Z3ph6NvDRj11srQnrFM1lh9aQXPzsvJaoUvD2FjxXvJaRtKNh2v9SxzYdjN:CWq4xD6N7Rj1urorYPnssqLxajKD2v8e

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2168-7-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2608-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1836-93-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2608-94-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2608-197-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2608-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2168-6-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2168-5-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2168-7-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2608-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1836-93-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2608-94-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2608-197-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2168	2608	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe	29
PID 2608 wrote to memory of 2168	2608	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe	29
PID 2608 wrote to memory of 2168	2608	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe	29
PID 2608 wrote to memory of 2168	2608	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe	29
PID 2608 wrote to memory of 1836	2608	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe	31
PID 2608 wrote to memory of 1836	2608	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe	31
PID 2608 wrote to memory of 1836	2608	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe	31
PID 2608 wrote to memory of 1836	2608	JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6E7F.B07

Filesize
1KB

MD5
1531aad882c58a6bcc55d48e58d57226

SHA1
aedaf6e07147240833f4ecc284844bd706f2ecf7

SHA256
a559d1f90e6825ca5edbe6a1a5f4a890374ba9962f31076c25b6ae61a4e863be

SHA512
801f96c34478de96a6a88274232c556fb22cc5efebcb9ecdf29f668f91eafa460733c9d4c3b698a689f8877cfe0a1d08914412ef839f14c7cdf2ee396ce91a27

Download Submit
C:\Users\Admin\AppData\Roaming\6E7F.B07

Filesize
600B

MD5
1c10965ca79d61d3df384c3ec77a81b6

SHA1
bf6f927090363613c7222d2eb52960560bf6d6cc

SHA256
f40490d692463f0454ec26c8d34b50d5ebc1072cc2007442275a69cda2e9e622

SHA512
2744b1f2ca7adb616c4b9887fcc33af8cdf5c0dd93a616bd870e6d649b6804b3d593fb3995122b8b806cae86cf28e0081fa929dda1c38d2b20e5fc2d79d83157

Download Submit
C:\Users\Admin\AppData\Roaming\6E7F.B07

Filesize
996B

MD5
00dc00116fc0b3c6ee06c29583b4df67

SHA1
e3db4794e58b7348e029232d797b376659fa76df

SHA256
9ef805abbcb68d61b95c1b6f691ffe4afe30e94dda7a15361e1544ccb3f24ea0

SHA512
438b87e5456aa11fb05bdc8d57f94c3695b5cbd4ab8e18108992a706f47c75fa33d666fe4453eb370b1574f88ffca523147c352b8b874747f771d2b6ece4b550

Download Submit
memory/1836-93-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1836-92-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2168-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2168-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2168-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2608-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2608-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2608-94-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2608-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2608-197-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads