cycbot | 4d841be30baeac58cce53882da63938c22cb125413cb9f33c90c3082b275b617

General

Target

JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe
Size

165KB
MD5

5117fbcd0183e295cabb023a91d042f9
SHA1

058e6e685816ebe67e75e46e6417dc74dc3516d4
SHA256

4d841be30baeac58cce53882da63938c22cb125413cb9f33c90c3082b275b617
SHA512

c6990713179133d433a7ed33a8c5eee57954a31875bd32054630fd68e39b67db447fe88c04d5b5eb242bcee6c6c60c925331492ed4e8c3ac5402c62782e264ad
SSDEEP

3072:ftec/ahkaBnTFaByG6OLeYAVOIiyzy7qTvGmZkiYi/HlGm046yBP:Ac/aCUnMYGNCdOIiyzyGQ+x

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2332-13-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/1688-14-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/1688-83-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/2432-85-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot
behavioral1/memory/1688-184-0x0000000000400000-0x0000000000444000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1688-2-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2332-12-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2332-13-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1688-14-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1688-83-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2432-85-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1688-184-0x0000000000400000-0x0000000000444000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2332	1688	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe	29
PID 1688 wrote to memory of 2332	1688	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe	29
PID 1688 wrote to memory of 2332	1688	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe	29
PID 1688 wrote to memory of 2332	1688	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe	29
PID 1688 wrote to memory of 2432	1688	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe	31
PID 1688 wrote to memory of 2432	1688	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe	31
PID 1688 wrote to memory of 2432	1688	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe	31
PID 1688 wrote to memory of 2432	1688	JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2332
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5117fbcd0183e295cabb023a91d042f9.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AE28.F0D

Filesize
600B

MD5
39048fc16fe66c9daec8971809cd9e4e

SHA1
2fb3047c237c27b8a1b2b024e651c3e0a8a9a745

SHA256
af91156cefbf56d1f7cdf109dc71b56fa609c7f164ceff923fd4ff35d84b447c

SHA512
70c4b56a1c586bd174bc06066fdd9a1c266191fe5864b75142518fb951c330150c92cea364dac5a52848abcaed9508bf2f7f26b23e7e73111a8acff35db6504e

Download Submit
C:\Users\Admin\AppData\Roaming\AE28.F0D

Filesize
1KB

MD5
205c4e70f32a4bcee86c87d56b3824bf

SHA1
be2f7c748d2a51b8e252e414ff7221e80ce4e74f

SHA256
c77352539b5fb8c383d6659747d11d5df47665feb665fb4f794b7ba0842caec8

SHA512
788747082d38d805dfbe2aefcb9960c3a7208868aea4e6ff2bdc1c7a1ab68de60cba169d70911ed4aa128c4e574fef448547094b694658d72ea3cc5c8caf3e62

Download Submit
C:\Users\Admin\AppData\Roaming\AE28.F0D

Filesize
996B

MD5
7addae2558c4ebc643c8f33dd3637fdc

SHA1
388f6f9a97cf63c6541943bc16b0b015edf03eb1

SHA256
824ed297fb96f29bc2f86c847847fd4b780827c9596fddc8731d704065865ad0

SHA512
3a4077cbad756238777ee67735d5b4af22cb5ef8778c62efa14f2bfb5d4dc5ae16e489b7f21307f2c7c1af49a58b2a0088c10cb1086aa490e2862bfbdcbb9af4

Download Submit
memory/1688-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1688-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1688-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1688-83-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1688-184-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2332-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2332-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2432-85-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads