cycbot | 2af880b9152a4785d27b44918cf0bfdb68034972d0da3dd25aa5035e99dedc93

General

Target

JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
Size

169KB
MD5

8bf9e3e6d854b5a7c1c04d434821d9dc
SHA1

3cf16f13c815a783a469b108af20d85f9fe9a96b
SHA256

2af880b9152a4785d27b44918cf0bfdb68034972d0da3dd25aa5035e99dedc93
SHA512

b1a9af3d94a8b04987c9d9739eebd300deda66c78a85ce66bcc0cda85a41b6510e76647bcfc90493c147dc8b80c6a2a7819f7230d1b148ef4ad267d24143712d
SSDEEP

3072:AzpP73rH/odEaUpf0gu5EgrlSI8XZrOpPQlfdYvdMk1olr5a5W4z:OPHQdvUpf0gKEg0IJifUdTofa5W4z

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4524-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1396-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1396-16-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/4540-130-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1396-131-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1396-301-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\DF6A7\\F2ED4.exe"	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1396-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4524-13-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4524-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1396-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1396-16-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4540-129-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4540-130-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1396-131-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1396-301-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4524	1396	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	82
PID 1396 wrote to memory of 4524	1396	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	82
PID 1396 wrote to memory of 4524	1396	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	82
PID 1396 wrote to memory of 4540	1396	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	88
PID 1396 wrote to memory of 4540	1396	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	88
PID 1396 wrote to memory of 4540	1396	JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe startC:\Program Files (x86)\LP\D48D\C69.exe%C:\Program Files (x86)\LP\D48D
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bf9e3e6d854b5a7c1c04d434821d9dc.exe startC:\Program Files (x86)\A7312\lvvm.exe%C:\Program Files (x86)\A7312
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DF6A7\7312.F6A

Filesize
996B

MD5
4a590538eb3b623156d898b46aea931f

SHA1
6cf89fbb3d7b5e5bc7a4c97ddeab9d2e298f877f

SHA256
c5c310d190fab742cc6409ef4b623196379f7bef05e16341891c6feed3bad8ac

SHA512
5f56ee6ba41b002b7a9abb5724f8589b4c4ce3bc48daa12fa0a54fa5af0aa05465e52f6936b9d13f222bddf97e8fa709592653255f6ec93dbf84811c57dc6c1f

Download Submit
C:\Users\Admin\AppData\Roaming\DF6A7\7312.F6A

Filesize
600B

MD5
b5d4c996bd21cd2e623ef196b554bd5f

SHA1
a4bb79e6c005eaf938b586aa31ec62925a9aa00c

SHA256
f87ceba28652cde4fc573448df35e6231ea33e575284e834b0ca7fae285cf9f9

SHA512
40ff7ab03b263dbce0712055c2a4c749c6415283d0e9e95a25dc6c059200901642eb439005f2cfc611a0f1e070feaabc528b0d1dbb8805b18ae98865e5243996

Download Submit
C:\Users\Admin\AppData\Roaming\DF6A7\7312.F6A

Filesize
1KB

MD5
198157ade6bbbc6b409cd0f06d16c2fb

SHA1
506e2f3aca2baf4f5bbfe5873f2da858f2c5ccf0

SHA256
8629718edbace603e47c86ac3069ccf3660206f50b84456db77e0bc1d63beceb

SHA512
647fd0e341054a99f1bf5743a2cead5fc9577ecc9e0883f0830f8b8c2bd92bf1962467284fc541d0480dd0cc71cab226a0df9c3a0359c5863a673734ff2fd684

Download Submit
memory/1396-131-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1396-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1396-301-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1396-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1396-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1396-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4524-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4524-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4524-13-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4540-130-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4540-129-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads