cycbot | ae82c4ac053704655dfa7738cbf5f918de8306e58e69df6dbc8f966b35d334be

General

Target

JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe
Size

174KB
MD5

6639fa0885d54dc9252cf464b20123a9
SHA1

86f7e226a3822d159c0f53cbbedfbe55aa782cf9
SHA256

ae82c4ac053704655dfa7738cbf5f918de8306e58e69df6dbc8f966b35d334be
SHA512

564de79a59841ef0180f2efbc25650eb848701c4783b8b92f97a5bdf0c6e0373c017b6de8d174f291b29187b3c981eb3c3c166b88ba959b817b296a3d48b2c4f
SSDEEP

3072:UaPhJ87gsFnHrgXECBgFk65vYwAIZocsX8LjEk77udf6W6tTEZ8:bhJ8XFnLgXKFxHNojgjTYf6WYO

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2920-19-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2548-20-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/860-83-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2548-84-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2548-190-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-2-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2920-17-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2920-19-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2548-20-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/860-83-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2548-84-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2548-190-0x0000000000400000-0x000000000048E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2920	2548	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe	30
PID 2548 wrote to memory of 2920	2548	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe	30
PID 2548 wrote to memory of 2920	2548	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe	30
PID 2548 wrote to memory of 2920	2548	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe	30
PID 2548 wrote to memory of 860	2548	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe	32
PID 2548 wrote to memory of 860	2548	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe	32
PID 2548 wrote to memory of 860	2548	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe	32
PID 2548 wrote to memory of 860	2548	JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6639fa0885d54dc9252cf464b20123a9.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E9FB.21C

Filesize
597B

MD5
7051e2140f19d7d4a485b78ef152f464

SHA1
b1b03ac7772b47032adf77a62068c7abd1400fca

SHA256
287959469777db93c70ceb2f35cd85083734417c18941621352e0af224a76b12

SHA512
caa938a0a16c9ef5f5b790ce2cb463ab537451dda5dd6e43d9e4fb488f3660a372c415c719e59f495d21bd30f694d12ab6f11872fe9da3b0379f84f409dee84e

Download Submit
C:\Users\Admin\AppData\Roaming\E9FB.21C

Filesize
1KB

MD5
d62fa92767800badc16d255d710a9814

SHA1
690773d9a95dca1a2cac6b39fcb005fefbd22191

SHA256
03ba85b2635ab134c73a16d147ce56894cc30b20983b1ec60d133db657d46d25

SHA512
4e21308a294cee72a5066ac8281fb99f3d0b29bf30cb8e736c2b77032cce72c666bd806110ba2234f8511fe1bb9f77295ec1aa713bcda7035a54ffaef3065646

Download Submit
C:\Users\Admin\AppData\Roaming\E9FB.21C

Filesize
897B

MD5
77150e5c9ae486744d012c3aa7481079

SHA1
78dae3bcce47440e6297f2a8df27beaca17d0cf4

SHA256
5af282685ea9deed25ad05369bf95d9e1ef38774b3e259f70aae24b04bb02858

SHA512
233bdcdea376836d2cf11b27f710e0f18208a03aae0e2a85f9b8fe31805b4e2b06ca3801910c2c08ef3ff8571576dfc728618d6f063f38f1172bb795d7e63e79

Download Submit
C:\Users\Admin\AppData\Roaming\E9FB.21C

Filesize
1KB

MD5
9a7ae82809fd7600401a7d0fa98f4e9f

SHA1
ce350b8eacc69bb9938a2c29ed37534705c41384

SHA256
7f61edf341891f222035ef82e527e492377175f008bee0f325fe84e1cbf86d93

SHA512
52f213e8e0844da9732d04bf9e08f114a4efdfe0121fc450ac0b688aad8bec1b195a8ffdbf6d90d8abd35f3afe0923a0524bff1e04169f05d7cc5c993d09ac17

Download Submit
memory/860-80-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/860-83-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/860-82-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/860-155-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2548-20-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2548-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2548-84-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2548-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2548-190-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2920-19-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2920-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads