cycbot | 2e812a315d54636b1f790c3bd72aed265b43ba0b3796c59b57b24332e6486fdb

General

Target

JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe
Size

183KB
MD5

a9a56b70ca7e66353ff97d34ff47b5e2
SHA1

1dbea21c0a281fe892055081b21d792bdf5b1294
SHA256

2e812a315d54636b1f790c3bd72aed265b43ba0b3796c59b57b24332e6486fdb
SHA512

c21e18b82c9bb5a8c6123d17d551e14097a92ac5d999726283a8ba05845593f9bcdd074d1387d40431be78e4a179bc17370a814721d29864f94b17f2e264ea7b
SSDEEP

3072:UEyaHHM3PGN9wsPJEm9NxH2MA6BMlbLyrNunAAdPWlAhfQ6oaKBxNFlhWC7RnFjY:U2HAPGN9wTM5RNrNunAAdzWvBLFlhWCE

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/3040-13-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2448-14-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2448-83-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2936-88-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2936-86-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2448-195-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2448-2-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/3040-12-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/3040-13-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2448-14-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2448-83-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2936-88-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2936-86-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2448-195-0x0000000000400000-0x0000000000470000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 3040	2448	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe	30
PID 2448 wrote to memory of 3040	2448	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe	30
PID 2448 wrote to memory of 3040	2448	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe	30
PID 2448 wrote to memory of 3040	2448	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe	30
PID 2448 wrote to memory of 2936	2448	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe	32
PID 2448 wrote to memory of 2936	2448	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe	32
PID 2448 wrote to memory of 2936	2448	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe	32
PID 2448 wrote to memory of 2936	2448	JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9a56b70ca7e66353ff97d34ff47b5e2.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9BE1.58E

Filesize
1KB

MD5
678064a50cde732da473868887cb0bcc

SHA1
c2c905a04e4a6337faec251bc9dce9626f95325d

SHA256
be5d61039fc4da4fada690f3f5e18e49d47a738ba37052deda54abde8f999d2d

SHA512
d50e27d43ea653cf347be8fd2546bf99a5d78ca8dc686f5129417a8170ff27997d7bbb237f5f9493ee06bf45d72fd0e63649f60ade27598441d513feeeb3a581

Download Submit
C:\Users\Admin\AppData\Roaming\9BE1.58E

Filesize
600B

MD5
e80885f936f1cb901ac96e4b8cbf666f

SHA1
dc81421a57a1894b31b476e04bc955139510f6c0

SHA256
d178d0693566980bf7692d44671bde5bc5d992cf921551221ce8514cd9942c23

SHA512
91dbe344e2a607294a4f6dc9bb1912ef0acc2a51169471b7c121e2fbce520ca0185ffb43da2dee958f2f5415cfa5ac68a988eeeec0e851cb3f7cdbf313a881b7

Download Submit
C:\Users\Admin\AppData\Roaming\9BE1.58E

Filesize
996B

MD5
c9506a5f0cfd588ff16dba737f17dcd9

SHA1
d2691c1a3f05fa1ddd7f5d16d3456af8875187d3

SHA256
88ed4f0c2fa6d9856a9474b839b4187af80f9b3e4b5d00492930d7eaf58a7d2f

SHA512
7f3f036f483c2c7d9f22cae4794087a9136e8c23327b5298091be7e860e3eb779336b48c0419a49539a13667c1e120b563fe24c39f1360ffaf3096f21c345e5e

Download Submit
memory/2448-1-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2448-2-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2448-195-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2448-14-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2448-83-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2936-86-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2936-88-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2936-85-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-13-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-12-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads