cycbot | 2af880b9152a4785d27b44918cf0bfdb68034972d0da3dd25aa5035e99dedc93

General

Target

JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
Size

169KB
MD5

8bf9e3e6d854b5a7c1c04d434821d9dc
SHA1

3cf16f13c815a783a469b108af20d85f9fe9a96b
SHA256

2af880b9152a4785d27b44918cf0bfdb68034972d0da3dd25aa5035e99dedc93
SHA512

b1a9af3d94a8b04987c9d9739eebd300deda66c78a85ce66bcc0cda85a41b6510e76647bcfc90493c147dc8b80c6a2a7819f7230d1b148ef4ad267d24143712d
SSDEEP

3072:AzpP73rH/odEaUpf0gu5EgrlSI8XZrOpPQlfdYvdMk1olr5a5W4z:OPHQdvUpf0gKEg0IJifUdTofa5W4z

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2776-3-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2228-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2776-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2776-17-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/908-118-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2776-120-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2776-270-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\E4856\\2062C.exe"	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2776-3-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2228-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2776-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2776-17-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/908-118-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2776-120-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2776-270-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2228	2776	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	30
PID 2776 wrote to memory of 2228	2776	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	30
PID 2776 wrote to memory of 2228	2776	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	30
PID 2776 wrote to memory of 2228	2776	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	30
PID 2776 wrote to memory of 908	2776	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	32
PID 2776 wrote to memory of 908	2776	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	32
PID 2776 wrote to memory of 908	2776	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	32
PID 2776 wrote to memory of 908	2776	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe startC:\Program Files (x86)\LP\2CDE\D3A.exe%C:\Program Files (x86)\LP\2CDE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe startC:\Program Files (x86)\56FC1\lvvm.exe%C:\Program Files (x86)\56FC1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E4856\6FC1.485

Filesize
996B

MD5
6bad599e116881262155fe5e01777fef

SHA1
dc8a3583a99a8b372a3c3475bf7ed3412eda2a3c

SHA256
1980c0ef0e6d2ebc1d6953f43a58ad18fbd0344139c1e2f2207d8b8ed6d7ca25

SHA512
9618c7a047f1442c4744106bf2d67031b4452ebb5bd77b87dfa654c1e2fedfacf1150bd96c7f9d96b1c424fde5732cd34ee90ae7525beb77c918d4c5b893417f

Download Submit
C:\Users\Admin\AppData\Roaming\E4856\6FC1.485

Filesize
600B

MD5
e4a444643faee15c9c6fa664f0bae9e7

SHA1
6a0664cbefdbf455827be62ae4bb777173962f8f

SHA256
7f25e40ca1ee372133aeadb82bc59f620ef98aa4b54a0415c1ee71a88202a2ed

SHA512
d4a78e47ae7514a26e4cc0e30d82f9e8e0b6529d84e818f6bd6ab6c2d70a3d6a43eefba794d18931cedcc570465ae7754c3a4b08c3e11201e2e9a3cd44e3b95a

Download Submit
C:\Users\Admin\AppData\Roaming\E4856\6FC1.485

Filesize
1KB

MD5
07ee8d30acf61814bc602f83a392ae90

SHA1
e4930ae1a2403c98fc8932b86e63e43a52d72038

SHA256
073a02480af27ced7dde92901268863f821d866b66219f482db740d9d4f61ac7

SHA512
dd6f38148a09d05ae3f3dd326464061425a7ff5bb5329c6020ecfc72257134a742729f91b62944132d02b7bfbc60c9ada1d192ff15389d0ab4297cf63177dfbc

Download Submit
memory/908-118-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/908-119-0x0000000001E00000-0x0000000001E7B000-memory.dmp

Filesize
492KB

Download
memory/2228-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2228-14-0x0000000001F40000-0x0000000001FBB000-memory.dmp

Filesize
492KB

Download
memory/2228-13-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2776-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2776-120-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-270-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads