cycbot | 1b9973292a4f821f661853620f588e74c12c7b0f5d5e2cc98dd9c4051762a874

General

Target

JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe
Size

177KB
MD5

69ceb7f4c6e602400dc93637ae94a4b1
SHA1

333c45c68307eff607cd802d6558775b0f9845a8
SHA256

1b9973292a4f821f661853620f588e74c12c7b0f5d5e2cc98dd9c4051762a874
SHA512

3cbab37b9531b036b800e206b518497603db392d807c11c434d8222e2daf7c156c14ca1212e9b45f3a50a367ed961ee3de6f59e3cc00da03c812cc97a4dfd594
SSDEEP

3072:o3RXLWmMt9ZeJJCErPUezCBjUZWiRzH2+zvt5iqVIENYhsZYbTaCewNZhumXqaHX:8dWHHaJrs8CBj+WiR2+Lv5VVNQsZYb8E

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1452-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2384-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2384-16-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2020-122-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2384-123-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2384-281-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\51661\\AAF5E.exe"	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1452-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2384-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2384-16-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2020-122-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2384-123-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2384-281-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1452	2384	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe	30
PID 2384 wrote to memory of 1452	2384	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe	30
PID 2384 wrote to memory of 1452	2384	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe	30
PID 2384 wrote to memory of 1452	2384	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe	30
PID 2384 wrote to memory of 2020	2384	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe	33
PID 2384 wrote to memory of 2020	2384	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe	33
PID 2384 wrote to memory of 2020	2384	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe	33
PID 2384 wrote to memory of 2020	2384	JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe startC:\Program Files (x86)\LP\5E15\424.exe%C:\Program Files (x86)\LP\5E15
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69ceb7f4c6e602400dc93637ae94a4b1.exe startC:\Program Files (x86)\61B5E\lvvm.exe%C:\Program Files (x86)\61B5E
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\51661\1B5E.166

Filesize
996B

MD5
709e71293ca3ac7a0dbe5ec8fb812f1f

SHA1
548cf4f998fea0f5b545c8116d260e83e9d81f9b

SHA256
3fc47321b3103c13b78697a2d4d14c008d7de500114cb41df8e67c0b06a82ca2

SHA512
68966031eac088ed1b78d380300341333934a6c32ff7c79688a9251a6ef62ed774970b80e18887714036c726d41d200cd2520ff2ba30f78e88d5972399818516

Download Submit
C:\Users\Admin\AppData\Roaming\51661\1B5E.166

Filesize
600B

MD5
48d7064f6a0339fd01e098546913de8b

SHA1
5f09930072e1cd1db863724c7dcf4cdf510ae8ec

SHA256
7a0adf61c6206ca3a954611bcedf714d1291f344b015346a83c6882a82715f8b

SHA512
c4a72f6dc57838655c37e3ebf84ddb2b7abdf579c559e7aba268dffdf5b525204542aa9a27a59ee85c413d292959c3979d85fadbfbc9944f0821241f21b43697

Download Submit
C:\Users\Admin\AppData\Roaming\51661\1B5E.166

Filesize
1KB

MD5
fbb9fea329d419173ea68f5c2555c471

SHA1
310fa735c5599fda39b40f9c44e9880a3b59275b

SHA256
0bf87f6aaaf359ca2afce06b0b0c2952184ff0c4fbfbfc1802f994e6d6d1fab5

SHA512
41f9830aa2937262b97d9509ad2548823ef394a481e90ca28fa2ff0d7d2cd4722fd246bde48b63735cc5af51a68a93cf879cf3630b2bfbd2898565f8aef0127e

Download Submit
memory/1452-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1452-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2020-122-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2384-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2384-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2384-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2384-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2384-123-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2384-281-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads