cycbot | 1b4a1bf079f1e92a89f4575056dc6ba8bfb8e084c3e6fb509124a8a06129ff18

General

Target

JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe
Size

165KB
MD5

4f4a4737f37007cca77e4b175c1a97b6
SHA1

01b331f18e1aef85e62c74ab48d5e8b17b95b8c0
SHA256

1b4a1bf079f1e92a89f4575056dc6ba8bfb8e084c3e6fb509124a8a06129ff18
SHA512

6bd70af46e9bafae1d2fedb98ebbcc17a74f1296fd8673e7a870416f8f6cc2f9fc3eed60ea3ed731e86de476109a1a998a4db534153be441a9ef38e73d69ff06
SSDEEP

3072:PGmj6ddD5mmWMbWFgx5DY7giA19NPyxHApWp09pf0rSa8y121:PGmjsG1Iugx5DY7nw9NP0oWp2Dp

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2840-12-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2840-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1448-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1448-76-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/620-79-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1448-200-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1448-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2840-12-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2840-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1448-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1448-76-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/620-78-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/620-79-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1448-200-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2840	1448	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe	30
PID 1448 wrote to memory of 2840	1448	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe	30
PID 1448 wrote to memory of 2840	1448	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe	30
PID 1448 wrote to memory of 2840	1448	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe	30
PID 1448 wrote to memory of 620	1448	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe	32
PID 1448 wrote to memory of 620	1448	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe	32
PID 1448 wrote to memory of 620	1448	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe	32
PID 1448 wrote to memory of 620	1448	JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2840
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f4a4737f37007cca77e4b175c1a97b6.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8881.1A4

Filesize
1KB

MD5
f8a31694cc0b17581504e659f5ec865a

SHA1
bce781813c7b589ac033fb8a2d946684c96dd560

SHA256
2c1f1266e6b318b399e49a4c4471cf8a7c597c17a42fca1a5b736182fc049c9e

SHA512
f0737e3c13b9e89d10effcf1abf15aef2a748f794cd324d121c387350b70859dc63c7d4f174f808bc8d55862d9d4de2230fe2403c992535feac25610fe507dc4

Download Submit
C:\Users\Admin\AppData\Roaming\8881.1A4

Filesize
600B

MD5
c08eb237ef095b538cc2ae6f7fe2af6c

SHA1
ee56d00d0b28e8feb88ef2f5fdcc8398670d428f

SHA256
b196d9abf2cf6f8b4e6e396e3c4f350927d91aa8d9d0663dab6b66cf167585b9

SHA512
25f03cc575e6b3ebd75584a5fe649c0b7871f6f6907d22121be40967f3a2628bfe1afe3f2e925cf586c7ae318eaf5c1e199d93ac4c552f0bac94c47c8585e583

Download Submit
C:\Users\Admin\AppData\Roaming\8881.1A4

Filesize
996B

MD5
4ab569f568ca10a74436c56122a6e2f1

SHA1
c50c2229b54f918b75ff3626aafa80a9c332de73

SHA256
5ee4761514b1786357531c65f07f4d01d411091abdb636345377c34b99534067

SHA512
5806242569a5c1a085285a9d9531eafff0a05eefb45155e45b76c88b07283a3619e6ab5f8b28d4b0d791d5e90edcf4b79f508b0f60cd513352f860be0960cbbb

Download Submit
memory/620-78-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/620-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1448-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1448-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1448-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1448-76-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1448-200-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2840-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2840-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads