cycbot | 66ac085c7eb8600d0418250ccdbc5b529d8d02c272adc6339943d2b6676cec3b

General

Target

JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe
Size

175KB
MD5

2edd6e9f94a8ac44da66992fff4a087a
SHA1

5af8af8df56a4ac8a9aa3c4121b48f01941697be
SHA256

66ac085c7eb8600d0418250ccdbc5b529d8d02c272adc6339943d2b6676cec3b
SHA512

4134f7dd5a19124f3b9c83d7199f976186b8cd5caf22a516612adb5eaa7f7556a55060b31dce3fcba8835364d6a1658b5ea204599fbf697a4b193c07d0b89290
SSDEEP

3072:KbzXh08N1lp5indoYxVgYOdSmuGZhVgxUZYYg:KbLh0i1lpvyVgYOd6GZb

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2516-15-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2320-16-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/1972-91-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2320-92-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2320-164-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-2-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2516-12-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2516-15-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2516-14-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2320-16-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/1972-90-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/1972-91-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2320-92-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2320-164-0x0000000000400000-0x000000000048C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2516	2320	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe	31
PID 2320 wrote to memory of 2516	2320	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe	31
PID 2320 wrote to memory of 2516	2320	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe	31
PID 2320 wrote to memory of 2516	2320	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe	31
PID 2320 wrote to memory of 1972	2320	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe	33
PID 2320 wrote to memory of 1972	2320	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe	33
PID 2320 wrote to memory of 1972	2320	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe	33
PID 2320 wrote to memory of 1972	2320	JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2edd6e9f94a8ac44da66992fff4a087a.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EFEA.673

Filesize
1KB

MD5
227bcc6a7b3f15678a368764487cd68b

SHA1
591b1dc23d2534d6511d43d088ed826c42d01405

SHA256
696523eb8aafd39e64a6dd6ad68a36a80a85aeb10cfe64cdbf84634dbaa596db

SHA512
40b0db88be072860843b0dd96c58099aa9cba79b51cc26fb2373cab697aff201f1c68824de0d28b84169e856a1503a1c2394a3bb2a3e05f17710e51c7fda5c0e

Download Submit
C:\Users\Admin\AppData\Roaming\EFEA.673

Filesize
600B

MD5
eabf47db16ffe033643d3076c2172e5f

SHA1
744f48a0ae55a9be5f4a8ce848cbce3422778dd2

SHA256
6264e83ffcfff6ecb7b90da7873966414cf6e4d6d5efd8cf4d84cd611fadc4ca

SHA512
c68899360c521ee04edce140e6afd2efe8d6785dc23bc77cf0c3735f2eaa1351d995166f73a891662e9406ab7aa2fd89ffa3da91d4651dcde6b5953d029257a6

Download Submit
C:\Users\Admin\AppData\Roaming\EFEA.673

Filesize
996B

MD5
586645d162411fd6aa91a6cc5a3de837

SHA1
a3a2f309232346b8bb325bf1b65d4a2228297a6e

SHA256
4b6c5f0b4b2cd4570ed67b166995f10db5c1d2d5e933d9e16953806c0891957a

SHA512
fbb44613607c2fea0f89019391e440279da561289970ab2d361fb852f6f813726b58773266b0e675370843a2d6a4f86bb098c2db0ea0f0ced3d2ccdc5d9ab03a

Download Submit
memory/1972-89-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1972-90-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1972-91-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2320-16-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2320-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2320-92-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2320-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2320-164-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2516-14-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2516-15-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2516-12-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads