cycbot | a9f678f2584dece46765d865ea47093c95fff10ec41aba79c783af33f23c576d

General

Target

JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe
Size

191KB
MD5

5ad2a1f41d991ea37f98f391c322d691
SHA1

325f2cb66a09c2a9df80f1080d890a6421f8a473
SHA256

a9f678f2584dece46765d865ea47093c95fff10ec41aba79c783af33f23c576d
SHA512

5854da127d3444a2a1959175e6d9a91aa9d5f118dd6ec84a382dffd9977c65c2a54a2c4eb00a2ea42664a180333ebbf8370d7f9cd62fd6510230219a2bf5eb47
SSDEEP

3072:PlMLhgWduH4XE6s4BkGw8ICa084QuzB8eJfbENnGuEc2+ml9q8SU6oAhpX:PqhgWdawsMkGTICT/fbENnGm2pbSdR

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2388-6-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2384-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1640-69-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2384-70-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2384-180-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2388-6-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2384-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1640-69-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2384-70-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2384-180-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2388	2384	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe	30
PID 2384 wrote to memory of 2388	2384	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe	30
PID 2384 wrote to memory of 2388	2384	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe	30
PID 2384 wrote to memory of 2388	2384	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe	30
PID 2384 wrote to memory of 1640	2384	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe	33
PID 2384 wrote to memory of 1640	2384	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe	33
PID 2384 wrote to memory of 1640	2384	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe	33
PID 2384 wrote to memory of 1640	2384	JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ad2a1f41d991ea37f98f391c322d691.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\269D.276

Filesize
1KB

MD5
02d13479d4b8cbb3e123b8e0a168ee6d

SHA1
1d52c43e16661fc987cb7116d31f0efc250c522e

SHA256
0b46124bfa4e6015c3182ba9b6dc90a7ce51530b8f622a7d96ddb6e73a3d8240

SHA512
9e6fa5c8b81e6310180c3da6a82946ea79f58bef20c0973837c7e4a9442a78cb66c1d6cd00fa17e12eeb9803dcab746e842c176a990f922923f3cb7736b323ae

Download Submit
C:\Users\Admin\AppData\Roaming\269D.276

Filesize
600B

MD5
64fd5e51b762df7c7429a09a963f52f1

SHA1
56f8eda110acf6db2f07cff69c13589f00548dee

SHA256
7dcccf8d584b433337bc662bb48a4efacb16de9749a8e70e2364395334aabcd3

SHA512
b65cf69e6e3f679ee037ec9c13388052463512c572c9e121f12d03d9ae6e0f4ed26a58d08d5a79889e6c0197be7fd2640b5648350ba364b29053746da3fefb46

Download Submit
C:\Users\Admin\AppData\Roaming\269D.276

Filesize
996B

MD5
bdb4411407397f9d77cfd81e48e0431b

SHA1
cfe139689e264fcf3ba6791553ea31c811bd3993

SHA256
a1b512986648269bb665ee2a1a3d6cc83d165f706382e623fbc4f914f40f943f

SHA512
9912eb18e58f72c02f68ad93c40b2be1352b290bac31fa11e1fba118a0c6ec984651649d96fc6335e21242055bd44c5a48ed30a696f056087f9aad8fc46fb2da

Download Submit
memory/1640-69-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2384-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2384-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2384-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2384-70-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2384-180-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2388-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads