cycbot | 4fd0a0b126a2e9e536a5954a7ba3ac14ecd2289551a35d6d352c587c95150d51

General

Target

JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe
Size

185KB
MD5

a08060e40ed8edd81f5cb631fd808d92
SHA1

2cd4ce2d5ce9add2d59cd872f139b62c14018fa2
SHA256

4fd0a0b126a2e9e536a5954a7ba3ac14ecd2289551a35d6d352c587c95150d51
SHA512

b2aaf13bf33e713e850ad128af3e8e9b1f140e469e363e6539a59b9b51677e11321cc9a3c460a5093be70a608b248d8e1a606d63069a186f3dc5174e8533c5e0
SSDEEP

3072:kLHECeIdBbtve6obdue87pXuLEupwb4DNyWRPNVKNnd5gSzXx9D2W1plcnV2SCU:ELVneJUpUx6biLPNYNn/zxZzplcnhC5

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/536-5-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2292-13-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/3068-75-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2292-76-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2292-153-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2292-186-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-2-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/536-6-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/536-5-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2292-13-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/3068-73-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/3068-75-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2292-76-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2292-153-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2292-186-0x0000000000400000-0x0000000000466000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 536	2292	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe	30
PID 2292 wrote to memory of 536	2292	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe	30
PID 2292 wrote to memory of 536	2292	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe	30
PID 2292 wrote to memory of 536	2292	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe	30
PID 2292 wrote to memory of 3068	2292	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe	33
PID 2292 wrote to memory of 3068	2292	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe	33
PID 2292 wrote to memory of 3068	2292	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe	33
PID 2292 wrote to memory of 3068	2292	JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:536
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a08060e40ed8edd81f5cb631fd808d92.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2F23.5D4

Filesize
1KB

MD5
6c432d991ee5538139e6b1133c026e02

SHA1
43291e09501a68118124e1b3b50d84ce793f168f

SHA256
08b22707b7bee5a3d149c68861562d286bb53eda11cd652c64c31d2e4f11abf0

SHA512
ba3a2b9af9c83a196912b622edf0c995bb93487e6de09b16ebd8cfa1e9b2fa5bea30c2831e238835b3080c548c55859402a5f2e0b80f8456f36ca6bb379b3754

Download Submit
C:\Users\Admin\AppData\Roaming\2F23.5D4

Filesize
600B

MD5
3bf81f1cebf4c7b73a026d56ad1c0840

SHA1
7ccdd12fbd7aecc56559fbf5f7474d22ad0c3288

SHA256
44e5600bc0a8f98e1566e6e58ef591deac698aeac528c4464b568b7d50f240ef

SHA512
ab204ac8cd85439f69384a569fbf7fc667c9b7d2ebfea1bca64618e5124f30cef3734ae98a5c80893192f5b13d067d0d9cf46be3ba06498d91e07b1b584e48a2

Download Submit
C:\Users\Admin\AppData\Roaming\2F23.5D4

Filesize
996B

MD5
f9e93be909cd12e3a43cf0906eab2959

SHA1
1fb778a8d827d4a81c85882fca65f8c5bb5a663b

SHA256
e3ad452262840c0d37051f93c8796f48f333b8668f64fd008bdac932b843dd9e

SHA512
3bd4cdf7da9d278c5f0ec28f50d35aba7f127aa8ae6c81cd36323c5e3ff42064be3e99b8dc7e7057ef2a8bbae71284b8520c66ca6159254b2dd475812854ac1f

Download Submit
memory/536-5-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/536-6-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2292-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2292-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2292-76-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2292-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2292-153-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2292-186-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3068-73-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3068-75-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads