cycbot | 7c9bbd2f437323203827b635edce5270ccc1d725540bf4c0050c38d60cb86486

General

Target

JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe
Size

171KB
MD5

ab1511354f5335345c749c1fdae82c10
SHA1

c537e09103702ef7721ead2ee3cccfa114f23a92
SHA256

7c9bbd2f437323203827b635edce5270ccc1d725540bf4c0050c38d60cb86486
SHA512

0c5f2541c0cad358f2aabf0294349f9c5c01af9e8586bb63cc12096ab181ac41827de5f49cc641ac4eeccedf1815798765b448509b7d51854d9869ce05e70500
SSDEEP

3072:/9ocr+PgxoG7R/T4Js8o1xlPU6GYYdNeYT/vYRwxR7QCBZwPPB9RfRn/FDyJ6:/VyGvt20vl6YYdNeWYRwzEXPpjGJ6

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2284-8-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2284-6-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2408-16-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2408-73-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/840-77-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2408-187-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2408-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2284-8-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2284-6-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2408-16-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2408-73-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/840-77-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/840-75-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2408-187-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2284	2408	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe	30
PID 2408 wrote to memory of 2284	2408	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe	30
PID 2408 wrote to memory of 2284	2408	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe	30
PID 2408 wrote to memory of 2284	2408	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe	30
PID 2408 wrote to memory of 840	2408	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe	33
PID 2408 wrote to memory of 840	2408	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe	33
PID 2408 wrote to memory of 840	2408	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe	33
PID 2408 wrote to memory of 840	2408	JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab1511354f5335345c749c1fdae82c10.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D1F3.A63

Filesize
1KB

MD5
589e1aa36c577e272c5cbc6807965807

SHA1
573579a955fa6d43f7ed14730dadea5b551a471b

SHA256
f0aabbc83177d1074c05a1755f8a42d147c80fddd172b15e0ca27e4eacbf2273

SHA512
7d45d9c673ce6bb7315948bee33281e76fac399d5a14685fb76477113ec1d3447145696f4e8e2f92e3240a1a7797085eebf6a56030aec813ac541212846ada00

Download Submit
C:\Users\Admin\AppData\Roaming\D1F3.A63

Filesize
600B

MD5
aa542b4acc3329b8d257bea636501790

SHA1
77bd224fd9e13dd5227b6ae2b778312cd66f6495

SHA256
b8fb839b6a0fe326f03d37e5b10776093eabc86201fd4412d4bac7e1094406d2

SHA512
1092809ca7ed277c5a3171a38acba4f907c45e94cd0581627604b1b8c13bb6b8b0c073b64f3e44bda2ed9ea3760554e02ccfdc9f5cb8c388753082cb6f34e381

Download Submit
C:\Users\Admin\AppData\Roaming\D1F3.A63

Filesize
996B

MD5
16fe494591f59b13e67a86c6519c0f32

SHA1
1bfbbc8d7f6c4042b19c09adb733bd8f77121060

SHA256
1abcccb83ce151f8fd05619771e60a09237760ec7b327b0713409a4af861c18d

SHA512
dcc36e8048f01892d2ab8a7a5845cc8a210f90b8dafe57631b077b79852121985f74aeabfeb7a78ba6447036fdb48cd7eaf039c112277919f801a64a5400e3e8

Download Submit
memory/840-75-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/840-77-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2284-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2284-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2284-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2408-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2408-73-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2408-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2408-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2408-187-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads