cycbot | a7e019440254f6e46023f64685405f1a592cf2ef96e8e36445b4cdc9ac09080a

General

Target

JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe
Size

170KB
MD5

693393035ce26d82c50c4dead504c6bd
SHA1

5524c7d882591610a9ce960cefeabfb5160f5a56
SHA256

a7e019440254f6e46023f64685405f1a592cf2ef96e8e36445b4cdc9ac09080a
SHA512

002240080d976cac7244d183a4b0fd0f295f790a83e7b5c94174c9cbacd51eaa5204a9763c23e2e40a1cd7567cae70be75a2fe7ed9fda926f7acd3732823c262
SSDEEP

3072:zD+/JEC1T8A3C/CXm9wFfsSnE5u3UDBKfySQ8kT1KEJqy:uRENUNlfsWE5ukDBjH84wE9

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2308-12-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2100-13-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2100-77-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2604-79-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2100-187-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2100-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2308-12-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2100-13-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2100-77-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2604-79-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2100-187-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2308	2100	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe	30
PID 2100 wrote to memory of 2308	2100	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe	30
PID 2100 wrote to memory of 2308	2100	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe	30
PID 2100 wrote to memory of 2308	2100	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe	30
PID 2100 wrote to memory of 2604	2100	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe	33
PID 2100 wrote to memory of 2604	2100	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe	33
PID 2100 wrote to memory of 2604	2100	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe	33
PID 2100 wrote to memory of 2604	2100	JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_693393035ce26d82c50c4dead504c6bd.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E5A7.34D

Filesize
600B

MD5
a3e96d2d30ef2533d3627e12d0d3ec12

SHA1
20c3d25fc8fba6863b2924cb37bca660421ec434

SHA256
cd298d36a2210bd6289cf8c3109cb0292db668efb8e6e2edd87bf5e247dcac47

SHA512
69b2eba5deffa8516d61c8ad6e1197e1532e3e0a8816c4364f62e71c3735b1f7770d677f2d8d065471b715b3ea8f726dd280cd94563be1e54ca7e602528ea4c4

Download Submit
C:\Users\Admin\AppData\Roaming\E5A7.34D

Filesize
1KB

MD5
43576ec51bc656f10bca712c92ec7cab

SHA1
067e8eeadaa424c545c5300c612378affd63b998

SHA256
3c99df0da3b56081f9ae9c0bf1383c78eae0c6e229f1d7d16925187a44ee0234

SHA512
f65535ba0f19a2be467b1c36806e119ae21bfb01e06a00380e89f21f1fe47a1bb4455627527688f8c6c26896a1aec0b7361f01bd83486f3530f04667fd0c0775

Download Submit
C:\Users\Admin\AppData\Roaming\E5A7.34D

Filesize
996B

MD5
8762206607c8f56868a61fb560ca3f58

SHA1
2c442f01a0d6cd20d47b51b5683ad0eb8a41ffd3

SHA256
0e4ced94bb03c52bc62f3a513dae1b215c04117c03ce256eeda1903498c9bac8

SHA512
2202bb44b7eee7f6cbc24d1d222c99ef3096a775010f761a77810e7b98b96ea83ce97b40454edf9fffb759d6682d229810045e404fe94e439f260d9e1a5420bf

Download Submit
memory/2100-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2100-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2100-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2100-77-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2100-187-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2308-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2604-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads