cycbot | 6ef37dfefa7c2103ebee671b0f71e6d92388065d3f1ae5fbdee3fc10fc5955eb

General

Target

JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe
Size

167KB
MD5

4d144e673c22f4dbf1b909a12a34c291
SHA1

bb16af5ce75aca73749fe417b966e07314e9343d
SHA256

6ef37dfefa7c2103ebee671b0f71e6d92388065d3f1ae5fbdee3fc10fc5955eb
SHA512

c5fb17732ec5fae36e94e52465979e3f9450f4af5b1cd45b1bc844d7528847f077fbdb59ae1120f548562cb304e8f252d76437a260cb4aefe9766fad07225c88
SSDEEP

3072:R6qyiqLQQQ6POMY/DVWyOg3+4DDUgPixxRmoV8ZVmJpyDJCz74eXOlCTl:R6qyiq0GY/ZWNg3+4DAGg8ZzlCf4eXj

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2704-8-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2420-16-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2420-81-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/1172-84-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/2420-198-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2420-2-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2704-5-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2704-8-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2704-7-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2420-16-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2420-81-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1172-83-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1172-84-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2420-198-0x0000000000400000-0x000000000048A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2704	2420	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe	30
PID 2420 wrote to memory of 2704	2420	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe	30
PID 2420 wrote to memory of 2704	2420	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe	30
PID 2420 wrote to memory of 2704	2420	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe	30
PID 2420 wrote to memory of 1172	2420	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe	32
PID 2420 wrote to memory of 1172	2420	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe	32
PID 2420 wrote to memory of 1172	2420	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe	32
PID 2420 wrote to memory of 1172	2420	JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d144e673c22f4dbf1b909a12a34c291.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DE09.B0A

Filesize
1KB

MD5
a04307fd1365e90e61de33d9e54b3fc5

SHA1
2b7ed0ccd877b05ad56dfe2365c76eb460fab4b6

SHA256
7621c7444734f1f5cda0e2a9565413a096f0332a96dc2355552a06ad6c16765e

SHA512
20f4980ae3020beb3fcdfcc046e92f97780fc663f0ba3407ab433d0c5e2ea594440f85765e4cf04f63b10f08feaea333a071487a06501491ef8484bb254faa68

Download Submit
C:\Users\Admin\AppData\Roaming\DE09.B0A

Filesize
1KB

MD5
e99ded1725673bebff9854d88556e79b

SHA1
e506331f9ab8625ab38cf32f2bbb16ea92eecb58

SHA256
3992d56a2a82b83e696e228bad254dec1de0ba797f226b01e3d10c1cac53d6f1

SHA512
a6b636314d3707ceeb1a8440401b5762590345c38293aa6d9ec0ddf83e8e495210b767cce356c9cb228cda8041f90a2dc1af1d17443ffaefc539fb269c69bb0c

Download Submit
C:\Users\Admin\AppData\Roaming\DE09.B0A

Filesize
600B

MD5
4bb1118ed7c61431067a79c738f90bac

SHA1
d7c83f448a60a0b504d954c6be991ab330e74594

SHA256
29ac7cc62695b52bfd4d88acee3c5777b7a3abdcd2a2d9effca2838b840a85e8

SHA512
bb4cf43f035cbd130dac09025a4af45fb938bdb7c0e27b1c26f78af818611997a66b6722e6073215ea4ff853c81329c723d678b6446108560becc88c69a14dbd

Download Submit
C:\Users\Admin\AppData\Roaming\DE09.B0A

Filesize
996B

MD5
c187ea35222010c42c3ad15d074c9e06

SHA1
7626ac6ef9591080d26e34f264233a9c93a437fe

SHA256
dea1a374c17187614a6ea9d851e5b177f99d489e1b9d96c973a0bb80db51b888

SHA512
f2256a9bd5fc7d597a803d373eca2ff35fe7b09f63c5d8cd180fdf8e23455ec03a6a96ef930b90d6aaa1f1806661ef23c7799fef9a63d0478780f7f3224a075b

Download Submit
memory/1172-84-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1172-83-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2420-16-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2420-81-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2420-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2420-2-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2420-198-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2704-7-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2704-8-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2704-5-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads