cycbot | 16a5958a11e87444be3d404523ba3ff7e1b9ab53711afe784bc171fa557a02f6

General

Target

JaffaCakes118_69783f704e9622634593d87025682fb1.exe
Size

165KB
MD5

69783f704e9622634593d87025682fb1
SHA1

051414fc0cd4e6ecd775d4181826f61025ac2e8d
SHA256

16a5958a11e87444be3d404523ba3ff7e1b9ab53711afe784bc171fa557a02f6
SHA512

2e20ac05ac508446df613bc89b452ce054400dce2503d8aa96aba567798462168726709b1d2f94b08ee007095b534f7d97deed4710ea751885f06d0122daca3d
SSDEEP

3072:+zyAKCVCN/u9TMoINGs8YqJzO7lXf5XtsCyy6QAV2/it+AriuF:+B/CNuTMDX9kuf5ryQa2/i1iu

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4104-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/384-17-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/384-18-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/4776-129-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/384-130-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/384-300-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\0D25A\\98442.exe"	JaffaCakes118_69783f704e9622634593d87025682fb1.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/384-3-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/384-2-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4104-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4104-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4104-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/384-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/384-18-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4776-129-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/384-130-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/384-300-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_69783f704e9622634593d87025682fb1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_69783f704e9622634593d87025682fb1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_69783f704e9622634593d87025682fb1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 4104	384	JaffaCakes118_69783f704e9622634593d87025682fb1.exe	84
PID 384 wrote to memory of 4104	384	JaffaCakes118_69783f704e9622634593d87025682fb1.exe	84
PID 384 wrote to memory of 4104	384	JaffaCakes118_69783f704e9622634593d87025682fb1.exe	84
PID 384 wrote to memory of 4776	384	JaffaCakes118_69783f704e9622634593d87025682fb1.exe	99
PID 384 wrote to memory of 4776	384	JaffaCakes118_69783f704e9622634593d87025682fb1.exe	99
PID 384 wrote to memory of 4776	384	JaffaCakes118_69783f704e9622634593d87025682fb1.exe	99

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69783f704e9622634593d87025682fb1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69783f704e9622634593d87025682fb1.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69783f704e9622634593d87025682fb1.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69783f704e9622634593d87025682fb1.exe startC:\Program Files (x86)\LP\42C0\FF2.exe%C:\Program Files (x86)\LP\42C0
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69783f704e9622634593d87025682fb1.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69783f704e9622634593d87025682fb1.exe startC:\Program Files (x86)\5A074\lvvm.exe%C:\Program Files (x86)\5A074
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0D25A\A074.D25

Filesize
996B

MD5
c09a246087a54673f38780b254434324

SHA1
748338e511935b3032b53d5ddee47cf8b153f02f

SHA256
b340c83cf489e88e3d3ab1f014f4772263ec46c369770e03221fadea18711324

SHA512
2a56e1ee65646385ea900d763b836c24bf3059506679ab79868f4e7590f8197b61071334df3880ef0ba6fd8a4b5fb4e1a8ef7f1014eeff1e6fdce8f0e60fc3d7

Download Submit
C:\Users\Admin\AppData\Roaming\0D25A\A074.D25

Filesize
600B

MD5
8257f39cddf22267fb3e6e334b88c04f

SHA1
11a386d92d197c9b3dbb724da77db8b7ebf682e0

SHA256
d224773c5ca131460f400246af247f999b8891c562a16e65d2f025c7dbbf56ac

SHA512
bc1ec5f40004dd6381c98fe956540e1ef94f6a78152fc06f78e856886cee8f06c645bd0ad408c74924a3493722e3da71b9d0ce65e62a0c44f82e5fe3775e9c27

Download Submit
C:\Users\Admin\AppData\Roaming\0D25A\A074.D25

Filesize
1KB

MD5
16403ab8b80bef605f39a77447ed6907

SHA1
396f6db39d2b96c2fcdf3b6c21ff1caf39585c6d

SHA256
ecc74ddc2604fb784a036db454377a35c71f599eb5f6333735d7ae1204882969

SHA512
6dd42460221369dfc797daa9964c255e5c32d168ff218a73910c264f1ffecba83ce896419f974e4fa55ffa48eda086d99a2e7ca92efb80b2d9e7bd19722a186d

Download Submit
memory/384-130-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/384-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/384-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/384-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/384-300-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/384-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/384-18-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4104-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4104-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4104-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4776-129-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads