cycbot | 247096a0f8ee29d360de5e01a089d2345b820e83bfa9175518128a98dfd0975b

General

Target

JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe
Size

179KB
MD5

588245bdb4ece067ee35dd21b49eb2d4
SHA1

d2b4f7c9337ce90c2a2170a2e65084d8d01195bf
SHA256

247096a0f8ee29d360de5e01a089d2345b820e83bfa9175518128a98dfd0975b
SHA512

cecbe71a9a41af7f20ccc5f52206ff06474a38164da504975a44489fe71b458bd5d584a97234961b9c1678a18c7e3022e84d78f3798f89723884d5f6f8321d37
SSDEEP

3072:HlvjWfBYXoPw9N6mILzoWHP2k08ANvT2ztGKiuuMlMSifHmML80tsJM/y72fd:Zj5oPw9kzjHP2h8+TYtFOMRifHm95r8

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2968-14-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1228-15-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1228-78-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/2448-81-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1228-184-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1228-2-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2968-13-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2968-14-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1228-15-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1228-78-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2448-80-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2448-81-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1228-184-0x0000000000400000-0x0000000000490000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2968	1228	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe	30
PID 1228 wrote to memory of 2968	1228	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe	30
PID 1228 wrote to memory of 2968	1228	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe	30
PID 1228 wrote to memory of 2968	1228	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe	30
PID 1228 wrote to memory of 2448	1228	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe	32
PID 1228 wrote to memory of 2448	1228	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe	32
PID 1228 wrote to memory of 2448	1228	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe	32
PID 1228 wrote to memory of 2448	1228	JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_588245bdb4ece067ee35dd21b49eb2d4.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\77A4.F03

Filesize
1KB

MD5
70196c0099dccc5e4efa2801bced6956

SHA1
006dd39a4b5a5110982c2028630ef743bbd5046b

SHA256
a1f7306bb1b21c5021fc3f14035bf889d592917590c96dc0f645fb649e1f8f01

SHA512
e41ab3eb7a02fdb60f80a20284c6d6e2a2df94449d6a859d3a30b383f6a5cc3fae969b0683b62368bd483b1544352c7137b0192c71882fb36a6d134f15f39cca

Download Submit
C:\Users\Admin\AppData\Roaming\77A4.F03

Filesize
600B

MD5
dc1f8acbc90f6b009fe4043e0ee14586

SHA1
402f40bcdc20997aa143d8fd04a58deceda7a520

SHA256
67c84b225c3d0e684b320cfd5824f4d8f8a602ee78f9bbf7220282ece11f716b

SHA512
8167196e7aa99182345af5c4ffd5dfbfed38d40a3e4c4c6097d9871462f5b412d9f0c15296e155c45eadb8696e8f27b800cf104107d826ab602a3e3f7d7c6417

Download Submit
C:\Users\Admin\AppData\Roaming\77A4.F03

Filesize
996B

MD5
b8fa9ef3431b80c711ae796d71da8cf9

SHA1
c28cac695fa10e947a481ba7623a34b5191f0135

SHA256
ccb96209fd4f5fb4f3a4aebd59c9c9229a8d1b4a4d975d2f01737af48dcd92b5

SHA512
25f0f8f1bdad5e059c40769d70c50576d7b4cfd09460063eb3d87fc9b0999ed6bdc36b1960b6969e9f972708a4d5f366a237ed81e8381ee98a82728b35f16bba

Download Submit
memory/1228-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1228-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1228-15-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1228-78-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1228-184-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2448-80-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2448-81-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-13-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-14-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads