cycbot | aa1663813c5c76b58c2d04afb9beff9ad69a2fcbdd45fdda9a8cc0245b9bb462

General

Target

JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe
Size

170KB
MD5

2732671ad78dbcf1138750598a0e2f78
SHA1

5cef2cc8f6f6f68614020b7e5513110047c0550c
SHA256

aa1663813c5c76b58c2d04afb9beff9ad69a2fcbdd45fdda9a8cc0245b9bb462
SHA512

5229fe79f8c1ae749a345329a5334542a36962106885c2c2925088113102040f2f7b3e403f49dfc340b8391b506dd4f38306dc5ac1f705070e7fefde3846a68f
SSDEEP

3072:DVwtr5YlFM/uEloPpM8tHfGu8EpTxPpSs8nWtESsEldgv3OPf5r2wyTq:DcVY/M/5ley81FDxPI50cEzn5r3I

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2620-9-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2344-20-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/980-81-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2344-82-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2344-145-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2620-9-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2620-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2344-20-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/980-81-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2344-82-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2344-145-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2620	2344	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe	30
PID 2344 wrote to memory of 2620	2344	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe	30
PID 2344 wrote to memory of 2620	2344	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe	30
PID 2344 wrote to memory of 2620	2344	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe	30
PID 2344 wrote to memory of 980	2344	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe	33
PID 2344 wrote to memory of 980	2344	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe	33
PID 2344 wrote to memory of 980	2344	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe	33
PID 2344 wrote to memory of 980	2344	JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2732671ad78dbcf1138750598a0e2f78.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AAC3.B14

Filesize
597B

MD5
4d354997299c1674010b710b177906b6

SHA1
333ecdac6ab580502b56e13a0d724ad38270974b

SHA256
c2049f4c5eac04d676724dbfded4bf9b41786fc742816cb53db710c6b6faad92

SHA512
c7b45aea3a0243dc4518cdc9737917a4493d670255cd532eb6697e9784a05f069e63e1a586c701fb9275ea39debeacab73e4aa069b23a03924b438e977bc080f

Download Submit
C:\Users\Admin\AppData\Roaming\AAC3.B14

Filesize
1KB

MD5
c3dd15f3746407928be96335ebd91f9f

SHA1
3a76586fb7d7c955a9cc951bf4901165f0e9066f

SHA256
afe32c5774f3cd848c63c40f0efe310e4484ad13f1cd39e9d43c4437f7b63e5a

SHA512
20fb9f4fd26142e67d798dcbf752d223101b2b3b42a6ac2c8ea1f423e06a84d224c950297ec807a5cd57ed6edcb7d082607b7fd83c7205d3eb90cdca2873aed9

Download Submit
C:\Users\Admin\AppData\Roaming\AAC3.B14

Filesize
897B

MD5
6257b710ac16487b750c4aa4c380eedb

SHA1
86f11f63445b2f0ffd7814af4557ca07b377aa59

SHA256
3cedcd7d2fe9647cc530557a8a06addf46deb3be74cfeaae434e51787596ed99

SHA512
560490973815069ba9fe448a71d76cd56c27ae3d16a87a1b9c3077b934ef108ca98e34aa8a511caf6de8d0308a86be2b318ffb679a4921783a071e1b1b012abb

Download Submit
C:\Users\Admin\AppData\Roaming\AAC3.B14

Filesize
1KB

MD5
55ce2a1eb7abd989b40116bb4e4e206b

SHA1
7e9a8d76df1b6c5d0b8831d2e66ac6bac143cb97

SHA256
43378d8216c7bfcb3aba824a839f061f8d61276859e56c287e2e1ac51a958d6d

SHA512
a68be2f594452665d63ea804dece07040ee0516efcd528b348666334837f6673accaa2a5542a84a529be122c9ed6c9c0ce4fa109c9d2cd686432da41750fbae7

Download Submit
memory/980-81-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/980-79-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2344-82-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2344-20-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2344-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2344-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2344-145-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2620-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2620-9-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads