cycbot | 4f9459e9137cfb89e4a9304442eee1358066ae5b153e5042ce5745aa154bd9bd

General

Target

JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe
Size

179KB
MD5

83065f3783a4caa70b8c56c2ea72ea3e
SHA1

baea94b3e19840348b04ec67ee471760d8fbfd9c
SHA256

4f9459e9137cfb89e4a9304442eee1358066ae5b153e5042ce5745aa154bd9bd
SHA512

a080993ddbdbdee885801d4895e99a75570bb3c1cd4f43d242ba9de7e91883593eaaa67026914eb8171acf521f638c1bfab34a987bdf60859c298b923fb01e3b
SSDEEP

3072:4LgXsi30fWSUsS6vG8fkPtPRROOmQL351FeZkTGNCCbWv/nGAGWYL:4ssRxzsPEOmQj51syGNCcMn//YL

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2688-7-0x0000000000400000-0x0000000000485000-memory.dmp	family_cycbot
behavioral1/memory/2688-8-0x0000000000400000-0x0000000000485000-memory.dmp	family_cycbot
behavioral1/memory/2660-15-0x0000000000400000-0x0000000000485000-memory.dmp	family_cycbot
behavioral1/memory/2008-71-0x0000000000400000-0x0000000000485000-memory.dmp	family_cycbot
behavioral1/memory/2660-72-0x0000000000400000-0x0000000000485000-memory.dmp	family_cycbot
behavioral1/memory/2660-165-0x0000000000400000-0x0000000000485000-memory.dmp	family_cycbot
behavioral1/memory/2660-202-0x0000000000400000-0x0000000000485000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2660-2-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/2688-7-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/2688-8-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/2660-15-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/2008-69-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/2008-71-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/2660-72-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/2660-165-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/2660-202-0x0000000000400000-0x0000000000485000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2688	2660	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe	30
PID 2660 wrote to memory of 2688	2660	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe	30
PID 2660 wrote to memory of 2688	2660	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe	30
PID 2660 wrote to memory of 2688	2660	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe	30
PID 2660 wrote to memory of 2008	2660	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe	32
PID 2660 wrote to memory of 2008	2660	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe	32
PID 2660 wrote to memory of 2008	2660	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe	32
PID 2660 wrote to memory of 2008	2660	JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83065f3783a4caa70b8c56c2ea72ea3e.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0F21.D09

Filesize
1KB

MD5
a441ef6bda6e7c5ac02e30f12b3160bf

SHA1
50568150c5a7a34354a0a3dee8ff737c41fad5f6

SHA256
5bd1cc7d140575888b49d2168f1f0c0de96c50c6face74933f10f0ebccabe427

SHA512
a87f8a530cdc9384a78790fefe816784589f8886116c14ac87b32d8de0a8f31929cf67eade840c4043897e6767a5b754a63320ee0883cab3529940fbb1b42ee9

Download Submit
C:\Users\Admin\AppData\Roaming\0F21.D09

Filesize
600B

MD5
3357fff2c004e80125a0c4627359d08f

SHA1
a82327e3f39a8344103c4b1178be004008c57db1

SHA256
3c37635ab37f8db0b4ab03a7bdd6dda237860d280af141b688db5b3a485a8f6b

SHA512
bb12a6ad387df5aff05f9799911daee5d5f0b970d24a9cb75f5786913391b9daea6403e3bbf940ea079624579b7eb6f48a9338598da39b0e26b03eb622548273

Download Submit
C:\Users\Admin\AppData\Roaming\0F21.D09

Filesize
996B

MD5
3fe902fabbf5df5ca64ff1a25e7bb1e0

SHA1
12e22624181a49ccb53d8f5702994d1fe6509526

SHA256
ac4f7b694f1d9fbe91912b71e332b8d00608a6914225a6247a3831834aa76fa8

SHA512
2ac0ea9d043d66253f8591e914161536b4b1c6ad242e5bacae20e863c1aafa19fe2e178deaaf76dc735914f8602b1ecb260c4aea2f3ca7da42e0035fef16adb0

Download Submit
memory/2008-71-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2008-69-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2660-72-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2660-15-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2660-1-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2660-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2660-165-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2660-202-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2688-8-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2688-7-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2688-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads