cycbot | 136b06a2ee6f1c5b6419cc4c37fd85b0d0903550e3839698d9a16ef2572776a2

General

Target

JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe
Size

168KB
MD5

3a57882a1c934a13be0a29a9d660bc4a
SHA1

e6f7446696dc8116efd51692f5ebc66adb2e3a92
SHA256

136b06a2ee6f1c5b6419cc4c37fd85b0d0903550e3839698d9a16ef2572776a2
SHA512

0162c84b1965a1ad00d97eb8342e0aba1f7213fc833163b98fe3c7f3813c90d3eaa19d8edb154ec71e4f4e76248272c84f8e07d82b33d89f6f826406eb43ead1
SSDEEP

3072:M4eoU6nPV+fNdW9np9fJDkU5xy4h0HWcrtEDrhFyxi1k0It:J1U6PV+f7WpRPxrgSrhFmiG0

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1960-10-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1960-8-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2064-15-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2064-78-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/1700-81-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot
behavioral1/memory/2064-174-0x0000000000400000-0x0000000000446000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-2-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1960-10-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1960-8-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2064-15-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2064-78-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1700-80-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1700-81-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2064-174-0x0000000000400000-0x0000000000446000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1960	2064	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe	30
PID 2064 wrote to memory of 1960	2064	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe	30
PID 2064 wrote to memory of 1960	2064	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe	30
PID 2064 wrote to memory of 1960	2064	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe	30
PID 2064 wrote to memory of 1700	2064	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe	32
PID 2064 wrote to memory of 1700	2064	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe	32
PID 2064 wrote to memory of 1700	2064	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe	32
PID 2064 wrote to memory of 1700	2064	JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a57882a1c934a13be0a29a9d660bc4a.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BA08.390

Filesize
1KB

MD5
6cc6953be0948cac4d292a9951c73ecf

SHA1
9404ff3b4dd4f0f00285cf59bd3b970212621ae6

SHA256
3e1791c678cd0d1b7297a2c986b3a7626003e3a27795f25f368ce1b84d79f221

SHA512
1b77e53b92c2fa1e1e987fdd9dbcbbee79f6f7729e8b69730ee6db6aa1154c89ab168fd2f2c516cdd7dd482ea270e87e13ea3cd5283a3183dbc6190e9da4c600

Download Submit
C:\Users\Admin\AppData\Roaming\BA08.390

Filesize
600B

MD5
4078d8faf24a898121a12fef1d742ee6

SHA1
5db1050a6f6ce6d96bc1e3d32042d50471136806

SHA256
7ddb6c3ea7757de6da82b3d2f955b30259674ef0b6bd33746c72c26c85801933

SHA512
b9255ce9fc5d177e20f28c8e098750a63bb6bbb4252cfd6dcdb9dbe19d34b03f273e0378dcfb432e035e72f949431b36b78204434e5d0b0d185323d85d3cc713

Download Submit
C:\Users\Admin\AppData\Roaming\BA08.390

Filesize
996B

MD5
23c8d7ac9b8ea7cf53b38db016bc3342

SHA1
9051283e6b276968fe1eb44ebcae15d314cc7a0b

SHA256
7c960c37a7a5016da190b474f4806591afe91eb36bb82d09168b0b207c147404

SHA512
23665d1a135a8da6828c917a57bc482701ecad1c61f75187400929b28bac251fbd3bd42312dfb6f2d86faaf2c6229411a220dbdfeeb6799a5d727269c01548fa

Download Submit
memory/1700-80-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1700-81-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1960-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1960-8-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2064-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2064-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2064-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2064-78-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2064-174-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads