cycbot | ae603234ce5d91faaebaa47d47025c1cb28d8e79c5820ed61b0f15a2b42cac9f

General

Target

JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe
Size

174KB
MD5

872defbb5a96b326fb18de1d4c3c89be
SHA1

6403420c52e662d4118e4fc95acd258e09183689
SHA256

ae603234ce5d91faaebaa47d47025c1cb28d8e79c5820ed61b0f15a2b42cac9f
SHA512

ebf29d9906a7c75cb780123324c3dcf7c4dd11f059cabc346122de7365a6b80e55b58aab5997cc947b08c2d62ea8869da28d3afea11d8dc3e27ac88aa5bd7536
SSDEEP

3072:2vW+2IUadlM4GD8hzSyM6kb5G1zIRObix0AoMBiOKoYkEI52Ap+hlmlzeHh4/T8I:2vW+Br6epkb5G1MRN0cBiroYI2Qlzb8I

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1672-8-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1652-16-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1652-77-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2704-82-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1652-139-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1652-194-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1652-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1672-5-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1672-6-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1672-8-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1652-16-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1652-77-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2704-80-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2704-82-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1652-139-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1652-194-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1672	1652	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe	30
PID 1652 wrote to memory of 1672	1652	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe	30
PID 1652 wrote to memory of 1672	1652	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe	30
PID 1652 wrote to memory of 1672	1652	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe	30
PID 1652 wrote to memory of 2704	1652	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe	33
PID 1652 wrote to memory of 2704	1652	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe	33
PID 1652 wrote to memory of 2704	1652	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe	33
PID 1652 wrote to memory of 2704	1652	JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_872defbb5a96b326fb18de1d4c3c89be.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1852.007

Filesize
1KB

MD5
24d58a55bcb546bcc834c57ad55cba47

SHA1
b69a9476574603ab19adef6dc820b41008f55546

SHA256
7ff843f155ddccbaa1dc210224bc2bd0ecd997c0e3a9ae40551355935013646f

SHA512
538304cacee40b4ca54f05e581131eefbffa68611be5ad994460adc2d0b4b6f5b1406cca7af98d5554120fabd6232d5319b9ac00ba8c4bf200802be42b62181d

Download Submit
C:\Users\Admin\AppData\Roaming\1852.007

Filesize
600B

MD5
cd708abde9e9b9a84efc7e54caf5b4bd

SHA1
1a677fb6d4fe3db1dc82f5a49114e5466a2e0be7

SHA256
d193cbff1d165c9e1114211ae4aa8452cffd9a59aea7af50a39828f0f3766bb7

SHA512
55bfb72228f770b0fcdd870d70006387cc297f7e215c4f2446cf85b96abeb2f51982c2751dc3a66e882a3627b218cd553c7a536e563f14894c2818f30a99e2bd

Download Submit
C:\Users\Admin\AppData\Roaming\1852.007

Filesize
996B

MD5
3faa932612e5fc3edbb2bc87b917091e

SHA1
e3d3d5296b65960cf466f421d4bc83b8c138794d

SHA256
de782a0dae64f6a19ecb198f9546aff4888e219cb62040e28f25a3d73ecd5eea

SHA512
ed6f394616292a9c1fdff9fee089962eae611d09f0da46c2d99c98fae71ba483192d7e66e54f1456395b07130b448820224a8762a791e4cc6aa3281f14b791d9

Download Submit
memory/1652-139-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1652-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1652-194-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1652-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1652-16-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1652-77-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1672-6-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1672-8-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1672-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2704-80-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2704-82-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2704-79-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads