cycbot | 71d27aeddb1fb19fc99bb1c0e116fc71bde13a8d6ef108e165a2fb7c83a62cf9

General

Target

JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
Size

176KB
MD5

4d0178ef0fb77976b1e307e2f0248086
SHA1

55e589ce232b74cef4d9cf17810b785af071140c
SHA256

71d27aeddb1fb19fc99bb1c0e116fc71bde13a8d6ef108e165a2fb7c83a62cf9
SHA512

12a3fbcf97182d4bf347652105561973bebea5d9ce99e9056d2ba327ec9497ccfc30cfc7f90db2e4a22c29dd6d7355471dbe1ca6b924c5f129ba6f9fa64d0553
SSDEEP

3072:Ih2uSGyG0clIGwsVr8WJ/jwmNnV9T8cLuOwJfyTlkYD59yfG6a:IhpSHYlJ5fcQSHOgfyhkYDHwGz

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/356-15-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/356-14-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/3052-16-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/3052-81-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/3016-84-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/3052-163-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3052-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/356-12-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/356-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/356-14-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3052-16-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3052-81-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3016-85-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3016-84-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3052-163-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 356	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	30
PID 3052 wrote to memory of 356	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	30
PID 3052 wrote to memory of 356	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	30
PID 3052 wrote to memory of 356	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	30
PID 3052 wrote to memory of 3016	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	33
PID 3052 wrote to memory of 3016	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	33
PID 3052 wrote to memory of 3016	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	33
PID 3052 wrote to memory of 3016	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:356
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\80B4.CE2

Filesize
1KB

MD5
a864dc0d02f33fecd69fa65dab32f186

SHA1
d3d58ad9edea640deecd992e72e5916f32a72ee7

SHA256
9be39b905d0ad7898b54b433f8bc9244e3f758b02e3514662e254c266d8294b0

SHA512
a7da9e9fef272da5c98217f947a02446c43f170ce01635276a21451625aa81c0f9e831b5f5e127c74f43aaee9007b26db7a1756904eaa9c64da0e9aaeafc7bd5

Download Submit
C:\Users\Admin\AppData\Roaming\80B4.CE2

Filesize
600B

MD5
dfc76af90fe1f9962aba611ddb06fefc

SHA1
2d97ef60d79275739b8fc33f69d15e070473b50b

SHA256
f06350332e7600f206f51866754b41f498877e7ef8fb6baa10d9d6d47168834b

SHA512
3dc631f6895abeb23be347a55610d91ee2c69dbbabd3cae025ce73929e22042b83042ba454e16f870f8b0eab270506e95e68ca39f783c3a082e5ceb965fb30d9

Download Submit
C:\Users\Admin\AppData\Roaming\80B4.CE2

Filesize
996B

MD5
d71c6f901c62c41d6c0a66807cb2204f

SHA1
8d1c5b903632442e4534949a4a1a1d8aa01be39c

SHA256
a17787d0d06b8c590befc54b3517334ae004d01d0be970715330212d020db0a7

SHA512
d8d59e31531e04db673f8318616ffee34947a29e8cb20a26229bfec523c41a2e3b37ac72f57ba3449a0478d510ce364736f0ebc9c304e0bdf0f80ae36b4c249e

Download Submit
memory/356-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/356-14-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/356-12-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3016-85-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3016-84-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3016-83-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3052-16-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3052-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3052-81-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3052-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3052-163-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads