cycbot | 75609dded5b09da047053ec8f8481c0de75f0656ab24bed8d32820fe6a90863a

General

Target

JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe
Size

183KB
MD5

668c1ff3722c38ed44be150edc679a30
SHA1

3cc40e80144b2972a10043d1cb799cc1dfad30be
SHA256

75609dded5b09da047053ec8f8481c0de75f0656ab24bed8d32820fe6a90863a
SHA512

e60696f389847b94b9b060814b82b3fec9b0db0bf472306e461a66ad691f036f68dd0254213aa52dfba51a0d29e3ec1330a1ec2203da6763f377df0c0d43a121
SSDEEP

3072:7qjd/dUiDkMtUfGoLQG2C0hONqvgEpRIHS3ZkEXWErUxG+Tgv49AiB5EWoybQcBm:ejdVUraUeoU/lhOeRnNXWbxG+TgvhU5U

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2880-8-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/3032-18-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2564-82-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/3032-83-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/3032-175-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3032-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2880-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2880-8-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/3032-18-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2564-82-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/3032-83-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/3032-175-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2880	3032	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe	30
PID 3032 wrote to memory of 2880	3032	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe	30
PID 3032 wrote to memory of 2880	3032	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe	30
PID 3032 wrote to memory of 2880	3032	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe	30
PID 3032 wrote to memory of 2564	3032	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe	32
PID 3032 wrote to memory of 2564	3032	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe	32
PID 3032 wrote to memory of 2564	3032	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe	32
PID 3032 wrote to memory of 2564	3032	JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_668c1ff3722c38ed44be150edc679a30.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F577.0B2

Filesize
1KB

MD5
61b7f4327d360c44fa0da5e6db9d2e66

SHA1
99d0a94f84e588b4885a366ff7c08a4b049eb8c8

SHA256
094bebecb751ee9962acc5efec1eb42094d116812e8d8061cbb25a94aa569d9f

SHA512
8ca65e249b7d970c3b96a7d80554df24ce3fa95512f8a4821b24f258597d6ab5dc4ce34f2356f4634418c40a3dca180a12f64e7d08d6fd602ab6f29dd46768d4

Download Submit
C:\Users\Admin\AppData\Roaming\F577.0B2

Filesize
897B

MD5
7398868bde76846bc6c1c3861af2d994

SHA1
882a218c7fdb8cfc773bda0b70ad2b1bcd3905dd

SHA256
a7fcf41de82136fe134eaf1d2f7694eb451f91d6d85001b7e91e6bcbd9281a09

SHA512
47200d84689c6c4531489a232988eef384fc9963363d52ff95120cbb1037a6f80ac48a66c4083792ad3294a7971da172bfb137a88850c75727b68a1ef451649f

Download Submit
C:\Users\Admin\AppData\Roaming\F577.0B2

Filesize
1KB

MD5
ec21d70b5f70800781a51cea127af094

SHA1
9aae14c5ff57de58f43f897f1948269b5d6d0186

SHA256
0d366cdeb269147866c5b8e04712d7fb4987153cff5b9984d491ac39aba5c41a

SHA512
f57dd8dd538f4d7c91a3dbfc701c86b4acdc6eb6dbb86593821a2bdbf8885a0a8cdbc2fb174f274fa084f1c8970041c581d3af14f157925bb642baa1fc863cd2

Download Submit
memory/2564-82-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2880-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2880-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2880-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3032-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3032-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3032-18-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3032-83-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3032-175-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads