cycbot | 19049d1449268f54ba0b168b2a34bf85e42ec9f348cca8c7f68d4ffae5c036d5

General

Target

JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe
Size

169KB
MD5

94f779ece253d16527cfe0c19b38da44
SHA1

37ac208a182607742bd30fd1928c6850dcbadd46
SHA256

19049d1449268f54ba0b168b2a34bf85e42ec9f348cca8c7f68d4ffae5c036d5
SHA512

e9c20ff322e38a8546fc9552c4fe494c8efea85e66f1038b70382050304beed28f94aad9eb29041170978d7bc262ed26d5374763a4b4f76b73474419f677de5c
SSDEEP

3072:zvb3LmAF9cNgIDhvLGtzBxx2u0mqBI1WGVovBzJ9MrkZMaC:3Ug6vLGPurzBI4tpF9Mv9

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3148-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4200-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4200-16-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/2096-81-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4200-82-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4200-186-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\34030\\6BE9E.exe"	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4200-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3148-13-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3148-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4200-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4200-16-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/2096-79-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/2096-81-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4200-82-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4200-186-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 3148	4200	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe	83
PID 4200 wrote to memory of 3148	4200	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe	83
PID 4200 wrote to memory of 3148	4200	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe	83
PID 4200 wrote to memory of 2096	4200	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe	86
PID 4200 wrote to memory of 2096	4200	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe	86
PID 4200 wrote to memory of 2096	4200	JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe startC:\Program Files (x86)\LP\9E93\1E6.exe%C:\Program Files (x86)\LP\9E93
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3148
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_94f779ece253d16527cfe0c19b38da44.exe startC:\Program Files (x86)\30BC1\lvvm.exe%C:\Program Files (x86)\30BC1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\34030\0BC1.403

Filesize
1KB

MD5
d661c7eede229e0a67369aab7633804d

SHA1
cbc8d3e7ef9de0ce223280775494bc0f66952602

SHA256
10271cc71787490c52605eab46d95378526c52899a66d3acb862e0a192152140

SHA512
a763c119b6400a50c8b0cb5c43a0ee71bac4d341aceff64aeb708b389fb664cb5c6ac417bda2af1cf1d598a2ff93f3798f5d92f06600a7c634e926a6a48cef6a

Download Submit
C:\Users\Admin\AppData\Roaming\34030\0BC1.403

Filesize
600B

MD5
fb06a74d73160c170cb9650a40a541fa

SHA1
2638f438d5d88e3d06806818156e218a0136b373

SHA256
ad0a6e1a1670dcb25f2daea99eb70af9f6464312f76baf6068c203a3743c7510

SHA512
94821c78e7f2687dff6f1a9006d1d81920414284bcf5911bfb00624f26ce75c6c32a152ebf915dba0a4cd6822f2ec53438118e986609e455c6d85aaa68d214cd

Download Submit
C:\Users\Admin\AppData\Roaming\34030\0BC1.403

Filesize
996B

MD5
73b38bddde8c77576680de2dd926f7ca

SHA1
3ac87a0192bc48da23b9087f8d352259d38b7b54

SHA256
ff388126ff3e03bc1da794c7e1e6903550508daf3c03a2daf49dad2033387e66

SHA512
243df38bb39c6d8270e6eae37ef467db2eb6086a5af3afd953236d8df67d72f553e9fded122caa2afc0aeddb19d45a39b6fe537918a73589bb92354b7785a17b

Download Submit
memory/2096-81-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2096-79-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3148-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3148-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3148-13-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4200-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4200-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4200-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4200-82-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4200-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4200-186-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads