cycbot | 7f840b737dc34568f350a71ecc58bcd3356f545cbc2c8cb9af706848ddee7b37

General

Target

JaffaCakes118_500f787662ae7c808173141fe95f4374.exe
Size

179KB
MD5

500f787662ae7c808173141fe95f4374
SHA1

fd2cda3397652461308c1bbe7b9e9c27461ecf45
SHA256

7f840b737dc34568f350a71ecc58bcd3356f545cbc2c8cb9af706848ddee7b37
SHA512

02b1dde1fd3467dfb5dda8ff3d74f0381fd69d180408923dd80f276369d3fb04d7a4e4dcffed84af43a10a759f94b06dd13a2388dcf06ebee4d047d2a9ad4532
SSDEEP

3072:k/NM1R5szd7Uq0/Xd8N//5Wj4so9qdkI6AxYo9G/OBTUFtsdnpVYjP1mdBJb6YJD:kZu3lg5iO9qf6AjFNVMP1yBJWW

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2572-8-0x0000000000400000-0x0000000000486000-memory.dmp	family_cycbot
behavioral1/memory/2328-18-0x0000000000400000-0x0000000000486000-memory.dmp	family_cycbot
behavioral1/memory/2144-86-0x0000000000400000-0x0000000000486000-memory.dmp	family_cycbot
behavioral1/memory/2328-87-0x0000000000400000-0x0000000000486000-memory.dmp	family_cycbot
behavioral1/memory/2328-180-0x0000000000400000-0x0000000000486000-memory.dmp	family_cycbot
behavioral1/memory/2328-215-0x0000000000400000-0x0000000000486000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2328-3-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2572-8-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2572-6-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2328-18-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2144-84-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2144-86-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2328-87-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2328-180-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2328-215-0x0000000000400000-0x0000000000486000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2572	2328	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe	30
PID 2328 wrote to memory of 2572	2328	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe	30
PID 2328 wrote to memory of 2572	2328	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe	30
PID 2328 wrote to memory of 2572	2328	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe	30
PID 2328 wrote to memory of 2144	2328	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe	33
PID 2328 wrote to memory of 2144	2328	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe	33
PID 2328 wrote to memory of 2144	2328	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe	33
PID 2328 wrote to memory of 2144	2328	JaffaCakes118_500f787662ae7c808173141fe95f4374.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_500f787662ae7c808173141fe95f4374.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_500f787662ae7c808173141fe95f4374.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_500f787662ae7c808173141fe95f4374.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_500f787662ae7c808173141fe95f4374.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_500f787662ae7c808173141fe95f4374.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_500f787662ae7c808173141fe95f4374.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2153.2E5

Filesize
1KB

MD5
925a349ed73843d84764d6843362119e

SHA1
895b280445d1310af3a38b686a9a3a33e2984b23

SHA256
f7bcd1aa8839a851ccad97558f08e911c6add81c1beed220ee3a0c645843badf

SHA512
f028630bbfb5911d9667ff8bddc644c6e47ac5af9f8c013c3a306a443d766cb408cbc003b12e4327ec6213874ef0ad9a68158b294a173f28b44774beea2e77c5

Download Submit
C:\Users\Admin\AppData\Roaming\2153.2E5

Filesize
897B

MD5
3e9b5a1ea89a2ee78162f8564c120e46

SHA1
bb5003db6b53cec12dc01a7db43ab296a57018c7

SHA256
c0b034b0dd279ce7dbc47bb948302adbf8f1febbc1308ba778e8f3579bba0b2f

SHA512
be06271fe9bfd3397e8a91afe77db31c30da4c196cefe58e22da68cdeb67bb18d19be9d950125df32cf07d7f81f14faa365e12668d024534bd7a2a76c6983126

Download Submit
C:\Users\Admin\AppData\Roaming\2153.2E5

Filesize
1KB

MD5
1b22c491eeed8affd4fa6c8e7d296679

SHA1
e63ba73ef467c07040e63fb2b671e3ffa448c41c

SHA256
987628f6401e92e52d806627fb063b806f9a4661f88fd311135147d0c9e432d6

SHA512
9e76ad4ebd3fa47abf2524d8889b44718a8e68b9713d25f600eb2b2fce7314310b4b59e96e7b779f1ba19f593b211e875034ff49f83ae418c46162f52f7e6046

Download Submit
memory/2144-84-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2144-86-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-1-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-87-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-180-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-215-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2572-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2572-8-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads