cycbot | 256fa557eb3df945bdfd42362e368fc25b854089fd649263093aa08540a4fae2

General

Target

JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe
Size

169KB
MD5

911b27dda4e00aa6a8ac3a39217e6abd
SHA1

a12b506a03f79a027611c596a7ee02eec2ea2552
SHA256

256fa557eb3df945bdfd42362e368fc25b854089fd649263093aa08540a4fae2
SHA512

4fe885b423e2052cf8ed4ee9005549b0821aa44e4e3a01f107eab6cdc7631becdeb77728f1c3ebfc99addef9bcbb378dd3b4da6ec751daf4e7ccd82626fe3723
SSDEEP

3072:L7RuhzE1AfWSNR2g8fcX/jTOnK8kKIVP/9I2ULMtjC9yfD71QOFE8BY:RS4JWRv8kvjTeKNK+y2ksjh774F

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2328-13-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral2/memory/3932-14-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral2/memory/3932-83-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral2/memory/3660-85-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral2/memory/3932-190-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Program Files (x86)\\Internet Explorer\\lvvm.exe"	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3932-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/2328-13-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/3932-14-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/3932-83-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/3660-85-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/3932-190-0x0000000000400000-0x000000000044B000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\lvvm.exe	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2328	3932	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe	83
PID 3932 wrote to memory of 2328	3932	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe	83
PID 3932 wrote to memory of 2328	3932	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe	83
PID 3932 wrote to memory of 3660	3932	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe	94
PID 3932 wrote to memory of 3660	3932	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe	94
PID 3932 wrote to memory of 3660	3932	JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe	94

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe startC:\Users\Admin\AppData\Roaming\conhost.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_911b27dda4e00aa6a8ac3a39217e6abd.exe startC:\Users\Admin\AppData\Local\Temp\dwm.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9D7C.42D

Filesize
600B

MD5
329308af189cf9f367a3626b4022a3a8

SHA1
1651678e6cde6fbfec8eb05e2ef297cc1b4b8960

SHA256
07870f74ca9048f0c56a43f0d6491e1d7c75a5564b4433e0e9429fbf777e762c

SHA512
b1d427452b24d0ca250fb694470ed7119d764f647d62ab3da2bbb2fd7d4bf1ee43607bb8deba0ac43043e10dafc507cf05cd0f8456ce261f12b93c6e38fcf819

Download Submit
C:\Users\Admin\AppData\Roaming\9D7C.42D

Filesize
1KB

MD5
f7c0774a4ab6ad11e2035023fb0ad9cf

SHA1
f3a767d47459eedfa817d6041ac3618eed2e9ed1

SHA256
960f1343ee62cb1ae15a24b8ce81be8410364f756c86595767ff685a4d5d9430

SHA512
acc61bb3769b487c9c48f457a2456d2099f8e842c2d7a1fb74bfb28987c85d705e34f428a7b5da3ddca834e4cabf0bba00b1754bfb1db771bfb068c64bbf89fe

Download Submit
C:\Users\Admin\AppData\Roaming\9D7C.42D

Filesize
996B

MD5
5d867c5860c9368d57f1334ba289dd27

SHA1
70240f84c9d2abc25958421066e463b3b119a7cd

SHA256
c20966f333528838a8f4c513313e6dfee9048eea25c76b65e9dbddac21c5f206

SHA512
424efb36d0fa19d9314a806db6535a0291fca4bf7b94ae39cf2371a3f1e7bb1d5ac8f672ef2ae0ec3f7f2cbba319021c7b32cdc5e546a65b0c391ec9ea6c84bc

Download Submit
memory/2328-13-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3660-85-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3932-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3932-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3932-14-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3932-83-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3932-190-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads