cycbot | 1553881425fa895cb6dfa1de4410fbdd3363f117c64cefec69764651caa71d99

General

Target

JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe
Size

165KB
MD5

81af0fe78842a1f601cddfb6dda09dfc
SHA1

f674df8566d9f5722c553d95cc05183603830cc7
SHA256

1553881425fa895cb6dfa1de4410fbdd3363f117c64cefec69764651caa71d99
SHA512

92992b9c055ae990dad4e96babd98f09895ea660b873f6d6a8a0b8966ec8954e0c57c59b0aa5dce306f3b8eeedb49bc8c638b139ec775c9e57e151a9e199f20e
SSDEEP

3072:snouwXfQPvUubHKBT3D8kH4/xA02cRHwneYifp5rMARkygyNbVGPzYtKrU:EouwXfQPvUuSDH4Jp2OaIRCJtHU

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1020-16-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1872-17-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1872-18-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2884-121-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/2884-120-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1872-122-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1872-296-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\C3F9F\\AFE07.exe"	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1872-3-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1020-16-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1020-14-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1872-17-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1872-18-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2884-121-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2884-120-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1872-122-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1872-296-0x0000000000400000-0x0000000000490000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1020	1872	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe	28
PID 1872 wrote to memory of 1020	1872	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe	28
PID 1872 wrote to memory of 1020	1872	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe	28
PID 1872 wrote to memory of 1020	1872	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe	28
PID 1872 wrote to memory of 2884	1872	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe	30
PID 1872 wrote to memory of 2884	1872	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe	30
PID 1872 wrote to memory of 2884	1872	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe	30
PID 1872 wrote to memory of 2884	1872	JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe startC:\Program Files (x86)\LP\073C\01B.exe%C:\Program Files (x86)\LP\073C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81af0fe78842a1f601cddfb6dda09dfc.exe startC:\Program Files (x86)\9FB7B\lvvm.exe%C:\Program Files (x86)\9FB7B
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C3F9F\FB7B.3F9

Filesize
996B

MD5
8ee70cfd6617038aa866dfc284e5f8a9

SHA1
788bd61e966a0aa660f1d0ce8ce92d9b68d903ac

SHA256
e81dbc2c958524345e42ffcd347c386954a0923a467aa11d19e43e114e4b3e9d

SHA512
a634139cdeeb68b8d3e258200895b3bbe2bbf486c620e0d71ce4e9c931603a9909e38d40e6d9f568e8372ff101249c8337428e60a3680f9325f890bd4b967e42

Download Submit
C:\Users\Admin\AppData\Roaming\C3F9F\FB7B.3F9

Filesize
600B

MD5
d497dc84ea84f5c03937381c6ccfcbca

SHA1
6972fb66325efd80ffd1eb7a67875197ab7bd924

SHA256
8b74d65c7dc2739950c3e4238520c716f65b4ae7d37d0fb0302418d84aa9fa87

SHA512
330b8b5c7888e343c0a72a7bca21160331b1480eab9696a4296cb8d17599d6b12c84eaecb15d7b66a7085a96b34948e87ce4db0eff6e0f6c5270c865495a59a1

Download Submit
C:\Users\Admin\AppData\Roaming\C3F9F\FB7B.3F9

Filesize
1KB

MD5
0a20a7bfb89f79c0ca3896437a5fcf14

SHA1
dd1184927f00c809b1e4d5482601d027ee958961

SHA256
018a32435f6f03e684666a3996a3bfec6052fc3b534a211ac87cd3eb25242bdb

SHA512
b446eb569e34b709442c67ba5fc0cb9f1063580b52d73e98dba118c4e1fbf801a5757e9f8dc966b89953f4cd977f3ca3b0a4482af4e5574592d1b13d5f168345

Download Submit
memory/1020-16-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1020-14-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1872-18-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1872-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1872-17-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1872-122-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1872-3-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1872-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1872-296-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2884-121-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2884-120-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads