cycbot | 2e1062b65969ca58be19f4662616ad52dda0e882507dbb1246b237cbb5c83408

General

Target

JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe
Size

165KB
MD5

5f2dfb12570a5e668e5ccd26d20dcddf
SHA1

c6e0d73cdfce951453342df4087b408d3e5aed0e
SHA256

2e1062b65969ca58be19f4662616ad52dda0e882507dbb1246b237cbb5c83408
SHA512

980c4b291dc9545f27078a0ec7777b4f591ddf25cfc4be03743e765119217f449711fe49499bd117e4ab42bc9fca6487f01476a0701ccdb3eb09f0c183926a94
SSDEEP

3072:wTaZF2SsPpRyNFW8EHX6951f6rQ4jPjKejMWMxVDDieArR1T2s:wTqF2VDyNy34P4hbKqt0RDiv91T

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2980-17-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/2384-18-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1100-136-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/2384-137-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/2384-295-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\02219\\4A0B9.exe"	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-17-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2384-18-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1100-136-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2384-137-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2384-295-0x0000000000400000-0x0000000000490000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2980	2384	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe	29
PID 2384 wrote to memory of 2980	2384	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe	29
PID 2384 wrote to memory of 2980	2384	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe	29
PID 2384 wrote to memory of 2980	2384	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe	29
PID 2384 wrote to memory of 1100	2384	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe	31
PID 2384 wrote to memory of 1100	2384	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe	31
PID 2384 wrote to memory of 1100	2384	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe	31
PID 2384 wrote to memory of 1100	2384	JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe startC:\Program Files (x86)\LP\B9C0\D95.exe%C:\Program Files (x86)\LP\B9C0
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f2dfb12570a5e668e5ccd26d20dcddf.exe startC:\Program Files (x86)\1993A\lvvm.exe%C:\Program Files (x86)\1993A
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\02219\993A.221

Filesize
1KB

MD5
da3e5e17d7ba52c345ac107feba22001

SHA1
0d6adf99b1b35f05108e8952689e146aee6949ee

SHA256
990f0fdb0c23d64aa921812dcfa588586bba4adfd9e9982e694ee54c66919700

SHA512
864c83c76eee7446a385606efec997da183ff2ebf25232de7ba351d0f9c83a61fbec4a53b61d1f928214e917f5e28aee51ec66d25c2d25333c164ef064644154

Download Submit
C:\Users\Admin\AppData\Roaming\02219\993A.221

Filesize
897B

MD5
91d86e9e9e848de0b7e8e2eb7d89c76b

SHA1
a78c97250cb734850ac189f7776204a2a9ec5eab

SHA256
05a2fb02d4b6d1019873a1b855a6b4a6dc177aa6970686c9670f3bbe0b522382

SHA512
a44f21a1b7024756551b1b3b32b2970dd9ba5a16e4887b9dbc3d0e98ef55454b32d52fbfa07232b0ff3530c705a3c51e61407740dd7d69bf485a2cf06e869e97

Download Submit
C:\Users\Admin\AppData\Roaming\02219\993A.221

Filesize
1KB

MD5
97b1ee084833dc8b5b1151d4f400730f

SHA1
d4622bdd5e39c7b34e60c86c745094feb698a392

SHA256
6f006dbc63ab6edcb5effb1811f97658883347a760a52c9a658e621b70e1d420

SHA512
aef0bf46fb462beb86e8f804bfb8bd9394a0f5007a47ba53509b8bb6990487f905da55dc58e8859de808bd1fb3bd240337f6f98704080608bfa93154906affbe

Download Submit
C:\Users\Admin\AppData\Roaming\02219\993A.221

Filesize
597B

MD5
a773e6157e8e0ecc2a88b7d35bfeb0b4

SHA1
0b7e61b9dbf208a490a3b75016398b44787e6777

SHA256
173e65ffbc2669875b3bf921facdae88d924168e59cebe5252a3add513085832

SHA512
0f5581b22c67c0fc506b29230d6d49ec26fc0c852a40f7e622c17a95cff5ae77e36e13a4d2b9114d3b6a161fc5a96361b4a07945cb04ebca656b905ba86d8533

Download Submit
memory/1100-136-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2384-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2384-18-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2384-137-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2384-295-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2980-17-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads