cycbot | 7eaa88f4310f8d7ef82fa898ad959951807b9a9d173f3f5bdbea720b87780e1e

General

Target

JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe
Size

169KB
MD5

3fa4d06340a531e57f764f5620827ccc
SHA1

6fdaf9fdc00c9252387c1638307ca1c1a6f8fd89
SHA256

7eaa88f4310f8d7ef82fa898ad959951807b9a9d173f3f5bdbea720b87780e1e
SHA512

1e358f11146c3ced136d4beb9b4c134d13b8c75801e791e36bdcc1a7e9d6931060bcde4e71a7c3498f2ce14d28d489b54388a83628b71976aa15e0fe2299a535
SSDEEP

3072:f/9h/w5RrC4LLxMSYjldWD0+n6IyjdAJD5L+cgFCNfmNFFbdsbff3sRo5c:n9Rw5R24LLySYjjjaem5ikGvRSs3

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/3060-8-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/3060-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1344-16-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2784-89-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1344-148-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1344-199-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1344-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/3060-8-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/3060-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1344-16-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2784-88-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2784-89-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1344-148-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1344-199-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3060	1344	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe	28
PID 1344 wrote to memory of 3060	1344	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe	28
PID 1344 wrote to memory of 3060	1344	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe	28
PID 1344 wrote to memory of 3060	1344	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe	28
PID 1344 wrote to memory of 2784	1344	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe	30
PID 1344 wrote to memory of 2784	1344	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe	30
PID 1344 wrote to memory of 2784	1344	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe	30
PID 1344 wrote to memory of 2784	1344	JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa4d06340a531e57f764f5620827ccc.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0B44.F13

Filesize
1KB

MD5
93bede7c46320a5266aa024987771279

SHA1
adafb697c41d9cd34cd7b198a0565012cb2f2c5f

SHA256
dc767dcd97eb27b111edb18bb0cd611307a154610d74511bb7bef6b2d100b200

SHA512
fd9a23a6868925f5707596df1665b1c45db3863cf7da5de68ef5e7f9105969b6c54de91862f721d7c1d014a05d9493e7dd8d00fd57cdf602f05d1ccd581aa039

Download Submit
C:\Users\Admin\AppData\Roaming\0B44.F13

Filesize
600B

MD5
774ee7ad918770688954b8d3e63a247c

SHA1
13f7de8edc9a60fa58fbdde5dd7074d2279e7a54

SHA256
ffadcfad5a5533acb9af3ddbc6369db25422916e32d28990d7a1df5f585b2f5c

SHA512
a04554e7ef50a909661b42f2dc6a6ee8d3420ddda124bf16094287c0a38d9ffb42006b19e663e3310c16e28dd4d33df3b66d54af380f5ebf764aac50c29ef88f

Download Submit
C:\Users\Admin\AppData\Roaming\0B44.F13

Filesize
996B

MD5
013d8d7029e0df318512b795699178c1

SHA1
795a9e519549ae2d1fa71fa9a49a7a39543e4ebc

SHA256
26f9607e5bbb87c236e9560dce7ae4bd2e13c748e7836b2ea4b509379b4dcbb8

SHA512
6f400167071896fb8dc7c9f4d48b98918c9f6bd42eaaba5532accc16e8ce6f96dbdb95be3934f08898972c2ed88986a46ee63463d989b4f82801814d9b3cd6ae

Download Submit
memory/1344-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1344-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1344-199-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1344-148-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1344-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2784-87-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2784-88-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2784-89-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3060-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3060-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3060-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads