cycbot | 2ac0c2a5db6fd4c6036094e98a8fe8dec405f4315311336354c8054b8accdaed

General

Target

JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe
Size

178KB
MD5

6f6a7dc4b25601d7519dac94414bd16e
SHA1

357d6461bb6cc65cf1b5f99efbd5851c90dd1b35
SHA256

2ac0c2a5db6fd4c6036094e98a8fe8dec405f4315311336354c8054b8accdaed
SHA512

1f648d9bea0fd475d10d8a3949a0c738bda42281ea584dd8e7777e7bd0310530867bcee7dda4b8f821a0deccbd93d4af50ab066d42cd569c9279c96ee446e2d7
SSDEEP

3072:nUz9KfT1QzdofiNOBBuvmOo3PwObUYEDVOL7az4o3xVL8I3pmLUht1h57wC7Ri5:nA9ipqAiNOBBc0wOpEDVCXo3vL8IOItO

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1908-13-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1908-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2304-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2304-17-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/1944-130-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2304-132-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2304-310-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\1E377\\DBD8E.exe"	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2304-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1908-13-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1908-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2304-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2304-17-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/1944-131-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1944-130-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2304-132-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2304-310-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1908	2304	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe	31
PID 2304 wrote to memory of 1908	2304	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe	31
PID 2304 wrote to memory of 1908	2304	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe	31
PID 2304 wrote to memory of 1908	2304	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe	31
PID 2304 wrote to memory of 1944	2304	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe	33
PID 2304 wrote to memory of 1944	2304	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe	33
PID 2304 wrote to memory of 1944	2304	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe	33
PID 2304 wrote to memory of 1944	2304	JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe startC:\Program Files (x86)\LP\8E31\D5A.exe%C:\Program Files (x86)\LP\8E31
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1908
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f6a7dc4b25601d7519dac94414bd16e.exe startC:\Program Files (x86)\7715C\lvvm.exe%C:\Program Files (x86)\7715C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1E377\715C.E37

Filesize
996B

MD5
392ce348f2969a6b1c3daa6a7f33ff86

SHA1
dfd5fb7ca9af90f6d33cd9d59e20f3bb7fb1c31d

SHA256
8c2c2e6148d05f836d8360de7301981d68ac67a20d9021d83e8493143914449e

SHA512
70785fa567868bb7003a397b3f7e1debe8ef8770f9640752830baf0c887fb2e12a2cb5a6109ecf17bfbcaf5c76ce31429f5fbd9c81e50e4f3e7203357ce31952

Download Submit
C:\Users\Admin\AppData\Roaming\1E377\715C.E37

Filesize
1KB

MD5
31b6d00769bcdba8b3b22915d2499682

SHA1
ffeb28e0f47cb039629c64644c0911005242ca06

SHA256
341635198c28c4cc1f72eb47aeb1c8d5b9fc4019942c6b6d000a7fd9af8c931e

SHA512
527d753cfdf03ea57f1f637168ad622a73c83d44b8d511a3c151889c634eb1955da11bd38002e8c0b4c2d68ee8a6bfe77a56f7dd4b7b786ea81438d952506c20

Download Submit
C:\Users\Admin\AppData\Roaming\1E377\715C.E37

Filesize
600B

MD5
85de36c292ae1a1a2cc11b3fffe6c535

SHA1
740e75d042ea7c1497d7d3c50eb0ff4724caa344

SHA256
8256280874a78f56820d5a1cf8ef8a1c36498dcb85bdde9ada0a6a16a20642bb

SHA512
1ec2f686f4dca9058796ec44d3ce89c744da1b47f94d531b76a7a55c1e7b69ff3d64805ff35499f30c993678220f538f3e99e5cada4d4712013e3b165a3c2219

Download Submit
memory/1908-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1908-13-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1908-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1944-130-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1944-131-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2304-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2304-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2304-132-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2304-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2304-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2304-310-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads