cycbot | 19afa28fa0ee6586c94f8f14b074199e42ddb2179ca50be1372ad6a5fced3663

General

Target

JaffaCakes118_ac336be0084400b8449911f3c6134816.exe
Size

165KB
MD5

ac336be0084400b8449911f3c6134816
SHA1

9cbe8899e8de4b8838bf85b59d9ac15437b3c9ae
SHA256

19afa28fa0ee6586c94f8f14b074199e42ddb2179ca50be1372ad6a5fced3663
SHA512

e4181f207d7fcae1f6996658ef451a6ff70ae9dcc984ba260254d092d4a4d206e059fa6fdbab507aa57755cc9de54f1ca75e5d3de1b7fc653acb550bc4cd0e64
SSDEEP

3072:ny0BNkzJWZFnBTb9d0o11UQEN7aKwhQG0zdwC4ScD6lToVnWWtBGoEdIKDo2RA/B:ny0jkF4n19d0o/ENdOfad8hDEQ5tkfIj

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2464-17-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1732-18-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1732-19-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/1976-147-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1732-148-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1732-310-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\48F9C\\49232.exe"	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-3-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2464-16-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2464-17-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2464-14-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1732-18-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1732-19-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/1976-145-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1976-147-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1732-148-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1732-310-0x0000000000400000-0x0000000000490000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2464	1732	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe	30
PID 1732 wrote to memory of 2464	1732	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe	30
PID 1732 wrote to memory of 2464	1732	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe	30
PID 1732 wrote to memory of 2464	1732	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe	30
PID 1732 wrote to memory of 1976	1732	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe	33
PID 1732 wrote to memory of 1976	1732	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe	33
PID 1732 wrote to memory of 1976	1732	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe	33
PID 1732 wrote to memory of 1976	1732	JaffaCakes118_ac336be0084400b8449911f3c6134816.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac336be0084400b8449911f3c6134816.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac336be0084400b8449911f3c6134816.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac336be0084400b8449911f3c6134816.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac336be0084400b8449911f3c6134816.exe startC:\Program Files (x86)\LP\3274\D5E.exe%C:\Program Files (x86)\LP\3274
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac336be0084400b8449911f3c6134816.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac336be0084400b8449911f3c6134816.exe startC:\Program Files (x86)\9CAF0\lvvm.exe%C:\Program Files (x86)\9CAF0
  2⤵
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\48F9C\CAF0.8F9

Filesize
996B

MD5
5c25071320424f7f8c28fbfd7e21d80a

SHA1
89b2b4e0455c39a71191746340a64ec3c94671f4

SHA256
bbb5aeaa3ed232203689b49427970daeacbd1136c6e1b31c549008faad5d5ec0

SHA512
c54a562a860eca001622215ffccdb62d0d655de99b5437b9d00b87126abed3ece0cfc04daab4de6563103b943c25a22bcda5b5eb59716eb5e20c95a248cbdc9e

Download Submit
C:\Users\Admin\AppData\Roaming\48F9C\CAF0.8F9

Filesize
600B

MD5
7971a61f7116c74b16f8401532106a34

SHA1
26f1a341c08ee14af3ec778a3259b8934e9e487c

SHA256
def6f8eb1bdfea1d007c75f7d38e5292278894b138d27f2ed988dd362103d8e5

SHA512
22e30641bb297d1485462baffe048543e15a1d57a2cea382ac9100ecdc439a3d6a619fd951d5c59712adb650f0267522d3bef378ffc7ed7584c75990cefffba5

Download Submit
C:\Users\Admin\AppData\Roaming\48F9C\CAF0.8F9

Filesize
1KB

MD5
49a75afc3a488be4f99c0abadef42578

SHA1
b2e733a600be43401d63c3698d12f83f5172da9b

SHA256
8a5feef9420da19f6f7025db327fcd08f8bd9024096853b3558c19773287e1dd

SHA512
980cdd816bd0de3d9d388c32c2539bc24e4fb1899936e43c2ca72bd8a059aabbbb2e3772ca8c5483316c68c3d03e1d2448a5fed5e843d2d1373c513fd4e80118

Download Submit
memory/1732-148-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1732-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1732-3-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1732-310-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1732-18-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1732-19-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1732-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1976-145-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1976-147-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2464-14-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2464-17-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2464-16-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads