cycbot | 6f1c028a4d54937d7efbf76a62a363da0913e8012a24a3a5a38807ade05aeb51

General

Target

JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe
Size

165KB
MD5

98fab08e5be7e045d7e26ea268987a09
SHA1

59c57316d35d3b29cd36ae80c3829c536bf2c178
SHA256

6f1c028a4d54937d7efbf76a62a363da0913e8012a24a3a5a38807ade05aeb51
SHA512

9989b3d4f1982e73cdd3eb81648116a07a0b6fd3c11e3ecb74559662a4d6a90f879c6422d876f7fe6b347596cc98e841fce7c31dd178e1321c4778fe395939a6
SSDEEP

3072:2WdS4UTsNp/bmTgJMg93Cv2QE60QbxfS8/iBKUhQ/Hsyalafbd8ewMzvN:20Se/aTgJv65NH/i8UKH9

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2744-6-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/308-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/308-71-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/3036-73-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/308-183-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/308-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2744-6-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/308-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/308-71-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3036-73-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/308-183-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2744	308	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe	30
PID 308 wrote to memory of 2744	308	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe	30
PID 308 wrote to memory of 2744	308	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe	30
PID 308 wrote to memory of 2744	308	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe	30
PID 308 wrote to memory of 3036	308	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe	32
PID 308 wrote to memory of 3036	308	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe	32
PID 308 wrote to memory of 3036	308	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe	32
PID 308 wrote to memory of 3036	308	JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98fab08e5be7e045d7e26ea268987a09.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\16AD.501

Filesize
1KB

MD5
a71ff29f730de639510b82b2ba7637ae

SHA1
80121ea5d5feea3fba4a9a6d40914bf7e030341b

SHA256
922470e5aea0dc9924923534ae795fd19c780a14ed4eb7c9550c217b5230088a

SHA512
c7c3543602a97c42a0580324695bacb8f7bc0beb8f2ad3b937a986858d9200e4886e39502c3b3f94edf246b84e1a6f9c533e59b8605c3870ee9e7bee09c9f54f

Download Submit
C:\Users\Admin\AppData\Roaming\16AD.501

Filesize
600B

MD5
10a84a6b7038d58935a161252f2783c8

SHA1
d50f145cc50a7fca8ba94ea105c00497de19ed62

SHA256
4dc7c2290b8859dd673d4777d0968a46491e3e777ab50f9a2bbf1e703bad1edb

SHA512
74e3f6c2be543ae15163430f644e4ac706e1c7064a04373c077298859679d83e6df23df5297791c6e825fad3ddec45a17053c4f0a708fbe10b1f67b368c4ccab

Download Submit
C:\Users\Admin\AppData\Roaming\16AD.501

Filesize
996B

MD5
94ff9d0efea5a298bad8f8beb97d0bae

SHA1
e56fbb1b6f9ea84ad6e219d4461c593d91d6bf8a

SHA256
74ef886cb81b59fffedc84565680f41a15eda5187572c6e6f49d98db0340e84e

SHA512
5ff9a5a7a0ea55fc01ce7bdb0f5f7172774e7d879c557eaa391e9f1027b6b914bcedeb7145e83200c7408f7c1c6e3c59cc75b21fb7509b7951e6634d2441fe17

Download Submit
memory/308-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/308-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/308-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/308-71-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/308-183-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2744-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3036-73-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads