cycbot | 4de643b66d308b4e8923a9865fd9637743f48e2169310ed6eae990dab52e80c5

General

Target

JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe
Size

176KB
MD5

21a5a10931d66bee19c9b2b917587455
SHA1

6718a4b026f557a68863ca1bbaacc583ef639902
SHA256

4de643b66d308b4e8923a9865fd9637743f48e2169310ed6eae990dab52e80c5
SHA512

d9ab7541c4ee10e4dd21e1f2f2b199e743e4c45e487d5e767f86f15a411a1dc4ff8ce09f5404aecf6db53d5fed2926d3e42faabefb3e3b3facc68b83b6880732
SSDEEP

3072:De7I1T0TeBNyamA+4X0sVPMZHG6TohKpPTSbufQjNM3NtE06woM0yxOoEgEZw:DeoT0TeBNynA+49EdFpTSbuwoE0R0cOy

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2156-7-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2012-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/552-85-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2012-138-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2012-185-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2012-1-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2156-4-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2156-5-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2156-7-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2012-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/552-85-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/552-84-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2012-138-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2012-185-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2156	2012	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe	30
PID 2012 wrote to memory of 2156	2012	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe	30
PID 2012 wrote to memory of 2156	2012	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe	30
PID 2012 wrote to memory of 2156	2012	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe	30
PID 2012 wrote to memory of 552	2012	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe	33
PID 2012 wrote to memory of 552	2012	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe	33
PID 2012 wrote to memory of 552	2012	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe	33
PID 2012 wrote to memory of 552	2012	JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2156
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21a5a10931d66bee19c9b2b917587455.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\23DF.D60

Filesize
1KB

MD5
2e21ca87c6435ef02c869a46f89ecac5

SHA1
4b621ab4d556fcd09ad697bed6782004feafcbfc

SHA256
00f893e16036cfa772ea7600f6cae3d4fbc278ca34d5c7d26515530ba3c56b07

SHA512
91070b027fea2ffbd32e8d16ac7d6fc0d32c484aeba61e8785ca96202c48ccfa38f372a3999d031c28e88890cbbf58cc6e11116ab543af81b9360cbe3f53800a

Download Submit
C:\Users\Admin\AppData\Roaming\23DF.D60

Filesize
600B

MD5
20de2e3a21e18d71aaf4f60f03b4bd73

SHA1
5bcf0b1589ec4d135f63151244b1b4e6bc5d9ef3

SHA256
a5f9ebd364c3d71b87a0f46f3884fcf0e9de7e44a3b1a428b86b304a27033174

SHA512
6477ea18d40b471244684efbc6db6b067fbe11e2e30f048fd6504c71725672165bed14642eaa949cb88d31db9648eea11419393eff9ffde1adf2c0d1448e7045

Download Submit
C:\Users\Admin\AppData\Roaming\23DF.D60

Filesize
996B

MD5
ae9e00033592f23dc8286b2c6ef98884

SHA1
aaa66296da74a17fb2db7442a4d8fb8935eef622

SHA256
a4ba2f5178371fab309d8a3838cbd500fe376020fb977f9794bff1e0167e6542

SHA512
e2492cf7d73193ed10808cf0c458d703011a9d0d54239ba066bfda9d8a7cba01a54682de9c8b97f31e969fdc9494c350a240040a71935fdb72dd1651b8ddb277

Download Submit
memory/552-82-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/552-85-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/552-84-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2012-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2012-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2012-138-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2012-185-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2156-7-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2156-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2156-4-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads