cycbot | 7d5426a37bf70bd110f7652288577133592cd5cd1e26fabf83aa321df6521c64

General

Target

JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe
Size

180KB
MD5

1fb59a8994c441c08bf9dbef99325a0d
SHA1

84cefe0e5b1ed635abcc3b49572b4fd7b7a28b2b
SHA256

7d5426a37bf70bd110f7652288577133592cd5cd1e26fabf83aa321df6521c64
SHA512

b7dfec7f14a4f1790c4d4b5a90c461b18fcc9f06c9836a329f65659d012586f1921936ab97273aca9e62c6c2eb019f2098f71e9a4247a547cb9920c7303d1658
SSDEEP

3072:R4DlgwOy4hsf3hyjNbhGKJ6TOAqOjhM18uI2WupaXgAFFVfvu+bAZFAzpYlgFDal:ylgry4avCP6u1vI2TmvVfvSZFAtYiDo

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2672-6-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2400-14-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2400-72-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2652-75-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2400-163-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2400-198-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2400-2-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2672-7-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2672-6-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2400-14-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2400-72-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2652-74-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2652-75-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2400-163-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2400-198-0x0000000000400000-0x0000000000466000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2672	2400	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe	30
PID 2400 wrote to memory of 2672	2400	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe	30
PID 2400 wrote to memory of 2672	2400	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe	30
PID 2400 wrote to memory of 2672	2400	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe	30
PID 2400 wrote to memory of 2652	2400	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe	32
PID 2400 wrote to memory of 2652	2400	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe	32
PID 2400 wrote to memory of 2652	2400	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe	32
PID 2400 wrote to memory of 2652	2400	JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1fb59a8994c441c08bf9dbef99325a0d.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F821.E3D

Filesize
600B

MD5
e45bcca47332050aa41ff7d3a25972db

SHA1
b41b0376f69045fa4ebd11da9b26ab567f9a03a9

SHA256
742086ec2105ddfa6d5bc10bb11e93dac2a71626c53d9296af12cb598c48e046

SHA512
36a5bc9038e2c9c060ca086872a2fa9d65eda0c6078046fed56f3453b62bfaa00ec19a6a8d73280593cceec1434515e74cbdda83bc123706b0950dfc3406fb9b

Download Submit
C:\Users\Admin\AppData\Roaming\F821.E3D

Filesize
1KB

MD5
85f6dc313dfd5dac179dac5966954fbc

SHA1
e2a7131c63705b419f2a8b106e1d4e3037b389b4

SHA256
7c2b684260eeec3921b50b225802f02219da1f8027aa77943af424b6d2d195ab

SHA512
4fa3aab8d62bbf8b7b2c9b4d7afaebccd4fffd2edc9a1f176575ae02a1da2ada4b789a7297786047e5296d0b8f55f17b8f5f914d1af0ba72ca1b19e3c12df655

Download Submit
memory/2400-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2400-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2400-198-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2400-163-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2400-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2400-72-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2652-75-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2652-74-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2672-5-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2672-6-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2672-7-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads