cycbot | 9fbca2ceb416d9f3d60ae3f605ea7742d926ce8292cefc3fd8bfdd5f8bfb3894

General

Target

JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe
Size

175KB
MD5

a73820f4eaaf0df520a8b68fec7988b9
SHA1

1f3414e43ff78d39abf737b895812c2a058f04b0
SHA256

9fbca2ceb416d9f3d60ae3f605ea7742d926ce8292cefc3fd8bfdd5f8bfb3894
SHA512

b6c026f9ad136ac5fa65c798013fb4ef7cc4f2595457b7da0fed13b14400637a912843b5ad27fd4c1969ef17cfc59e002bfcebd61965f5bcbd77e0cec9a9171b
SSDEEP

3072:Sy4pwRZu/VqfypIPBTHzWjR0Jwv9wZbcQ1A4FIkRkPzdAHgfD5dfB80mp:Sy6wRZ2Vlp+HSeBcWz+Pz+6D5Fu0S

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2968-13-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2228-14-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2228-83-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1860-86-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2228-192-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2228-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2968-13-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2968-12-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2228-14-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2228-83-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1860-86-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2228-192-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2968	2228	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe	30
PID 2228 wrote to memory of 2968	2228	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe	30
PID 2228 wrote to memory of 2968	2228	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe	30
PID 2228 wrote to memory of 2968	2228	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe	30
PID 2228 wrote to memory of 1860	2228	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe	32
PID 2228 wrote to memory of 1860	2228	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe	32
PID 2228 wrote to memory of 1860	2228	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe	32
PID 2228 wrote to memory of 1860	2228	JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a73820f4eaaf0df520a8b68fec7988b9.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E1CA.C20

Filesize
1KB

MD5
abebd7e05b7a316278316c2006105d8d

SHA1
028bfb8a98132dab4940e8542046778796f1c278

SHA256
1ba1b7a77e8d1dbaa059d2c0d97ed081f6f2d4e8639e249e6ac78bdb78805d10

SHA512
a72495ee6f9cb8d11c6b9ce2365278c23fa947ab8441b7d11a97a08db39ffcee6a8f161e61a24e37a012bce295212584ec101f41bfe9d65126b080c2413dd1d7

Download Submit
C:\Users\Admin\AppData\Roaming\E1CA.C20

Filesize
600B

MD5
8192b064158bc8d498543864e88e0845

SHA1
3a26e16855ac3387706370b0ea187c0246a731f5

SHA256
ca6442393d6604331322f4528748f1dbf910da4fe70a25a6fe3a4b24e580c66e

SHA512
d15c947d6e54d0f079d2c6fb6b95200743ea3d9a95b2e41e0d04a45e1720179f235b09379dc225d7ab646a8aa51fa5f33b1e550ca08cd92f2f16e52ef4d5af98

Download Submit
C:\Users\Admin\AppData\Roaming\E1CA.C20

Filesize
996B

MD5
34041550b819a3dc27f5d288cdedbb04

SHA1
ef278489d7f060d5e64b07262d276a9a489fa4fe

SHA256
78158c788989f43c6f6b51aae342eb6c5656713634542ab44cdb2fe85d3d80d7

SHA512
075e891d2cf06b729cae5573e1a4704d72792a2c2ef4d6f15fe6b5995cde103ea745ee6f90eaa769712671a0f45c2641bda028534d429afc6f225b5b54a18afa

Download Submit
memory/1860-86-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2228-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2228-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2228-14-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2228-83-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2228-192-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2968-13-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2968-12-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads