cycbot | 71d27aeddb1fb19fc99bb1c0e116fc71bde13a8d6ef108e165a2fb7c83a62cf9

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/01/2025, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
Size 176KB
Sample250115-e6x4fa1mdx
SHA256 71d27aeddb1fb19fc99bb1c0e116fc71bde13a8d6ef108e165a2fb7c83a62cf9
MD5 4d0178ef0fb77976b1e307e2f0248086
SHA1 55e589ce232b74cef4d9cf17810b785af071140c
SHA512 12a3fbcf97182d4bf347652105561973bebea5d9ce99e9056d2ba327ec9497ccfc30cfc7f90db2e4a22c29dd6d7355471dbe1ca6b924c5f129ba6f9fa64d0553
SSDEEP 3072:Ih2uSGyG0clIGwsVr8WJ/jwmNnV9T8cLuOwJfyTlkYD59yfG6a:IhpSHYlJ5fcQSHOgfyhkYDHwGz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/356-15-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/356-14-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/3052-16-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/3052-81-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/3016-84-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/3052-163-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3052-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/356-12-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/356-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/356-14-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3052-16-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3052-81-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3016-85-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3016-84-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/3052-163-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 356	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	30
PID 3052 wrote to memory of 356	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	30
PID 3052 wrote to memory of 356	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	30
PID 3052 wrote to memory of 356	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	30
PID 3052 wrote to memory of 3016	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	33
PID 3052 wrote to memory of 3016	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	33
PID 3052 wrote to memory of 3016	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	33
PID 3052 wrote to memory of 3016	3052	JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:356
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d0178ef0fb77976b1e307e2f0248086.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80B4.CE2

Path C:\Users\Admin\AppData\Roaming\80B4.CE2
Size 1KB
SHA256 9be39b905d0ad7898b54b433f8bc9244e3f758b02e3514662e254c266d8294b0
MD5 a864dc0d02f33fecd69fa65dab32f186
SHA1 d3d58ad9edea640deecd992e72e5916f32a72ee7
SHA512 a7da9e9fef272da5c98217f947a02446c43f170ce01635276a21451625aa81c0f9e831b5f5e127c74f43aaee9007b26db7a1756904eaa9c64da0e9aaeafc7bd5
MD5 SHA1 SHA512

Submit Download

80B4.CE2

Path C:\Users\Admin\AppData\Roaming\80B4.CE2
Size 600B
SHA256 f06350332e7600f206f51866754b41f498877e7ef8fb6baa10d9d6d47168834b
MD5 dfc76af90fe1f9962aba611ddb06fefc
SHA1 2d97ef60d79275739b8fc33f69d15e070473b50b
SHA512 3dc631f6895abeb23be347a55610d91ee2c69dbbabd3cae025ce73929e22042b83042ba454e16f870f8b0eab270506e95e68ca39f783c3a082e5ceb965fb30d9
MD5 SHA1 SHA512

Submit Download

80B4.CE2

Path C:\Users\Admin\AppData\Roaming\80B4.CE2
Size 996B
SHA256 a17787d0d06b8c590befc54b3517334ae004d01d0be970715330212d020db0a7
MD5 d71c6f901c62c41d6c0a66807cb2204f
SHA1 8d1c5b903632442e4534949a4a1a1d8aa01be39c
SHA512 d8d59e31531e04db673f8318616ffee34947a29e8cb20a26229bfec523c41a2e3b37ac72f57ba3449a0478d510ce364736f0ebc9c304e0bdf0f80ae36b4c249e
MD5 SHA1 SHA512

Submit Download

memory/356-15-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/356-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/356-12-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3016-85-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3016-84-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3016-83-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3052-16-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3052-1-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3052-81-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3052-2-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3052-163-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads