cycbot | 4c2bafb2d4176e927a84c61f86305ad04ad48f69bc0d59960e9b2a3eeea187be

General

Target

JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe
Size

179KB
MD5

6acba1b2c9296394ac9065daf88da511
SHA1

3421dff8f94190ff63f7037776ac0c7a68598024
SHA256

4c2bafb2d4176e927a84c61f86305ad04ad48f69bc0d59960e9b2a3eeea187be
SHA512

6543e93de70c1da8ae4d6f022e65a9e659eff8023e23fd72f09cf9852bf50be85b230dff8cd3eaca7b67bfe8b16791f608a0a8295ca31b9a83f2c455fa556737
SSDEEP

3072:lIotXDNcWCAV1yq5a459SF52TqlaeJTjvAqFwT:lIUXDeqvyTiSR3jvVF

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2752-6-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1308-13-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2156-83-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1308-84-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1308-171-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1308-204-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1308-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2752-5-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2752-6-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1308-13-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2156-81-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2156-83-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1308-84-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1308-171-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1308-204-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2752	1308	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe	29
PID 1308 wrote to memory of 2752	1308	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe	29
PID 1308 wrote to memory of 2752	1308	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe	29
PID 1308 wrote to memory of 2752	1308	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe	29
PID 1308 wrote to memory of 2156	1308	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe	31
PID 1308 wrote to memory of 2156	1308	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe	31
PID 1308 wrote to memory of 2156	1308	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe	31
PID 1308 wrote to memory of 2156	1308	JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6acba1b2c9296394ac9065daf88da511.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F865.C65

Filesize
1KB

MD5
6ed49a9fe6193766b34514f22184d8d2

SHA1
a243dcee646602200282171e7d92a7b13b066c9a

SHA256
02943d25530fd83ff10e511d1a82c92195584058733a0323f8c5c78accac8b09

SHA512
e5841646930b2b083f1e482d7ee13e537b9ac1aafa4ae354d5cb1223bf6714e83f4a7f8b65c6ec43090077e489ef45f0e9703fcc735f943c3d73fca14eba8fa7

Download Submit
C:\Users\Admin\AppData\Roaming\F865.C65

Filesize
600B

MD5
b96d6e982d09c9f89b159af61af017b2

SHA1
d2cf00d45c37d48c82fe34371506c8e98a9c61ac

SHA256
af0cd09add81b79bbc8b9d33bf8b9c57c883601a0153d368a80613425f8d0cee

SHA512
367aaede90211c010f713394fcae79c40e0699509ebf34646107027aaadc7b46b577c0c913a88bdf7d992359d7073b54b5f9be27d7170359e6bf03267196bebf

Download Submit
C:\Users\Admin\AppData\Roaming\F865.C65

Filesize
996B

MD5
f9e5416e71087b89040d3a9da66de585

SHA1
06cf1b1a8574c492c29f6a59e8fbfc9956e57901

SHA256
262a92db957d2cf7f36c47f4f4659ff245679d8f3c437a447c68a629a8660f02

SHA512
c15339068068216973924b9f4a3b13ccb64a787e1e6eb39e882b1e389b2ba46bcd92189ec0942e35719eaa35669d230a1ea1e1b0ce7591c2befd30eda95b1b4e

Download Submit
memory/1308-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1308-204-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1308-171-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1308-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1308-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1308-84-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2156-81-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2156-83-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads