cycbot | 1fbd2d21d2701a6b0404d9cc6a450820da3efaa28889b2978290ced398b63b82

General

Target

JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe
Size

165KB
MD5

7aec16a8fb5f01f89e648e335ab38cd3
SHA1

ecfbdcdff8e1536413e26ac257278fd31c522c1c
SHA256

1fbd2d21d2701a6b0404d9cc6a450820da3efaa28889b2978290ced398b63b82
SHA512

b3348027a8fad6a22a95a63bb30f1512bcea92f79777ca14205c24d9115641415f31358fc057bee22cd98a33c8b7a25db80440d05d27b6ab97d7be1327eb29a2
SSDEEP

3072:h5G2xOekJm/xV97W5OcP2kexGB+IQTca3ThqGAT5mekez5JvWXAn9F+lhw:XB7kJm/xr7W5Og+Y+QOh0w0zWXeSlhw

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2104-17-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2104-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2376-18-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2376-19-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1496-123-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2376-124-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2376-282-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\1C2CA\\3CD43.exe"	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-3-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2104-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2104-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2104-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2376-18-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2376-19-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1496-123-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1496-122-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2376-124-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2376-282-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2104	2376	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe	30
PID 2376 wrote to memory of 2104	2376	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe	30
PID 2376 wrote to memory of 2104	2376	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe	30
PID 2376 wrote to memory of 2104	2376	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe	30
PID 2376 wrote to memory of 1496	2376	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe	33
PID 2376 wrote to memory of 1496	2376	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe	33
PID 2376 wrote to memory of 1496	2376	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe	33
PID 2376 wrote to memory of 1496	2376	JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe startC:\Program Files (x86)\LP\43C1\BF8.exe%C:\Program Files (x86)\LP\43C1
  2⤵
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7aec16a8fb5f01f89e648e335ab38cd3.exe startC:\Program Files (x86)\CA404\lvvm.exe%C:\Program Files (x86)\CA404
  2⤵
  PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1C2CA\A404.C2C

Filesize
996B

MD5
54ea8732fa088211122e783371765d61

SHA1
d41de787e4a91435500c71c2ea21e7224b55a496

SHA256
1e7cb8c803969a9c1eb40a40fd560241ca23984df0c54606ff4d69d0fb290bac

SHA512
c30ab668de19f01e61bf0f540abc02936ee1a36b24e76c233b96434952ef40807f170866c672ebd990b40ceae0da74e1c579ea7eae998612e080ca43e6d43e4e

Download Submit
C:\Users\Admin\AppData\Roaming\1C2CA\A404.C2C

Filesize
600B

MD5
f5f269bdf9bc2cb6f5699bd17d16628c

SHA1
583286671172baab9d8f54be6b38d80402926271

SHA256
a2dd5b5ccde781858cf920fb0b9d5c324be212b70ee51c44da0b27b6900305d3

SHA512
039de05c685fc02b6eafca3ad7af1cdc9ee2a9c886b8248214f1bb4dff71beeb0e8957b31f61127fdb87a46113fd19ae2f3b8e86ee0087c8a20f5c5b08a40474

Download Submit
C:\Users\Admin\AppData\Roaming\1C2CA\A404.C2C

Filesize
1KB

MD5
b0eeb07cbf45e80002695a3b092f7603

SHA1
fb3d9a634f4e11f65a599e17e3b6eb410054c181

SHA256
3c97e2792126128df4b40b17dd6cc54f1333da62604e76443aa4890336454c60

SHA512
686b666c2f0fd6bdfb0b329a49dbc9919ce23ef7c8d99a3c46c3d17190f4c97a00eec63bdf2e6ebaf41cc8285f887e2cad2a10d9c9f5eada2735fb0c7fbfb2e9

Download Submit
memory/1496-122-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1496-123-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2104-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2104-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2104-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2376-18-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2376-19-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2376-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2376-124-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2376-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2376-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2376-282-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads