cycbot | 1fa001abcfaca3c32c016bb183dddc3d26a6f344aa452986d540ea4d199101df

General

Target

JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe
Size

171KB
MD5

429913e1cb8b1ead462b24d06d4f2456
SHA1

03b99b0338ba69014a6ec6c2fb48fd9ec5140a4b
SHA256

1fa001abcfaca3c32c016bb183dddc3d26a6f344aa452986d540ea4d199101df
SHA512

568b16e9fb8aba967cd0b74180b15b0cef9cf212d0afc03cd8e8f5d11b4460a5b181647e33bd5d576d337fbdd8034925539b4987fce8db5b14a0be1da4b128ee
SSDEEP

3072:pgRhPXq8b/aW2S7AxN9jt2qidhoFgug7S57a5XeOl8Zjx6lyf1chWj23U:pf8b/aFS7e9jtydhoFgug755XFuZV6ll

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 8 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1568-3-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1568-2-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2512-9-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2512-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1568-20-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2812-81-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1568-144-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1568-155-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1568-3-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1568-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2512-9-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2512-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1568-20-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2812-80-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2812-81-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1568-144-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1568-155-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2512	1568	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe	30
PID 1568 wrote to memory of 2512	1568	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe	30
PID 1568 wrote to memory of 2512	1568	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe	30
PID 1568 wrote to memory of 2512	1568	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe	30
PID 1568 wrote to memory of 2812	1568	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe	33
PID 1568 wrote to memory of 2812	1568	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe	33
PID 1568 wrote to memory of 2812	1568	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe	33
PID 1568 wrote to memory of 2812	1568	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BD18.5C6

Filesize
597B

MD5
8537034d34f97dd836020152496be7a1

SHA1
e3dc1117047cba37f31ba343601af8df73a88f2c

SHA256
3f964fc5f9968445666be7b5fdae4f8fd8d3d3df8d94d2307d8b24742185c2c4

SHA512
2646e4330591250c48fddaa3ca87e306d490101d40cacfd1fa3ccb342f649fd7353e9f1e03e5ad8964baa0cdc55e00fb539971f8df8f7428e3c7906a4cea6fb5

Download Submit
C:\Users\Admin\AppData\Roaming\BD18.5C6

Filesize
1KB

MD5
6ff8d3d757c864841ad1d1259bfcc856

SHA1
fe3cdae31de9478f08f2c3e68a24046cfd397b19

SHA256
b3f2295831af08896d3c80c9fd4dec2e4b10eb1ef9a6db6367ee17e3666177fb

SHA512
97e1ba30811c6d2abcd208332e2fc25f0e9ae62eaa53a3eb1f7fb42cc9ad57ecc060aafc2ca5bae53fe7d246db744523b9133b0018820e0baa58e185d8cf69ce

Download Submit
C:\Users\Admin\AppData\Roaming\BD18.5C6

Filesize
897B

MD5
98ba496bfb13a2f029d7647f69a6bf07

SHA1
8d068f1ff86c2f65d8de37223109af3963ff6f9a

SHA256
6c26c0414898ed813ec8016ccb5d1cd9cd8620f004c9ca7486fc9adba28c5023

SHA512
95d02733879985ca6f916f557f7a05d3968cb7f4049aceabf486b55081008fe3043a19bd8fa79d9dc8fa56d22582d0663ae7e16de10a5cf9ea6d98ddc5c003ab

Download Submit
C:\Users\Admin\AppData\Roaming\BD18.5C6

Filesize
1KB

MD5
094dd2cc24df88c605f0e1e19d2a5632

SHA1
817a504eea27a18efa1b9370ee8519947b4e9edb

SHA256
f3fe256032ec20fc786140cb3997733750889b0bab225405f354c7475d10bfd4

SHA512
97b924ba1b89a4b20ad751f9646b57a6f5229d308e9b40421e12381c2f0897ae743d1787e3da51b4d1847e9c0b173e79e0d303fd449f9516b55acced0f876910

Download Submit
memory/1568-20-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1568-3-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1568-144-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1568-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1568-155-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2512-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2512-6-0x00000000004E0000-0x00000000005E0000-memory.dmp

Filesize
1024KB

Download
memory/2512-8-0x0000000000522000-0x0000000000540000-memory.dmp

Filesize
120KB

Download
memory/2512-9-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2812-80-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2812-79-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2812-81-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads