cycbot | 179f7063356e1222d1353b37d8d199788b3c956794c67855883d9e12c5e5fafd

General

Target

JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe
Size

192KB
MD5

b332d188e82d8636b71ae672a635b426
SHA1

97b195559cab0263c7315b8cfd18530645c105e0
SHA256

179f7063356e1222d1353b37d8d199788b3c956794c67855883d9e12c5e5fafd
SHA512

30c5576a33f992f11040a5f27d2b16b290708835375aa841a76959200e20df97b1fb6bb385d8fad7d98e08ec8a92b2bfded6e74c0450ec53466022288092f721
SSDEEP

6144:QD+oT3FohN/vvUG2M+tmSwsVW2l0sfOsKj/YfTs:XCWh1MGOnLJx

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2304-10-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2248-15-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2304-16-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2248-78-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2296-81-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot
behavioral1/memory/2248-178-0x0000000000400000-0x0000000000470000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-2-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2304-10-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2304-8-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2248-15-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2304-16-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2248-78-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2296-80-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2296-81-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2248-178-0x0000000000400000-0x0000000000470000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2304	2248	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe	31
PID 2248 wrote to memory of 2304	2248	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe	31
PID 2248 wrote to memory of 2304	2248	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe	31
PID 2248 wrote to memory of 2304	2248	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe	31
PID 2248 wrote to memory of 2296	2248	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe	33
PID 2248 wrote to memory of 2296	2248	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe	33
PID 2248 wrote to memory of 2296	2248	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe	33
PID 2248 wrote to memory of 2296	2248	JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2304
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b332d188e82d8636b71ae672a635b426.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\51E8.BB9

Filesize
1KB

MD5
8bf7a5821d6032af5c9be2d7bbc88a49

SHA1
f3aa2cda4f109ad66bd7df1c9a0e4e1bf0a41cef

SHA256
da2640c0b74e5beaa8574f0dc14f4a56a581019ee79d7ea109bdcf4c1a5ff052

SHA512
ef834619f0ab7b07f289923b5543a4014910d5e3c6331c816cacf68ebdc624dd20e5d0570981a7cb8b25fd9a7a80c6433e0349bdf4450099039e1e9d3a217aa4

Download Submit
C:\Users\Admin\AppData\Roaming\51E8.BB9

Filesize
600B

MD5
35f1e0001a44029f43b282bc20c48b8a

SHA1
dc00e72f4661d8e27ceb2cbc701182b7c402d7ab

SHA256
44d466be00cd27c2c9acd7d84299ab1ad632819cc8c75f12f9b872ebb4984fb6

SHA512
01b1705aaf0b6edcd155b76e61ba8f4015da15b1240163cd91fea6c424ba21749909eaa59fb1f8b9e72f6ed4844645a47450c89455756b0db241433b4e5b7443

Download Submit
memory/2248-1-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2248-2-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2248-15-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2248-78-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2248-178-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2296-80-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2296-81-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2304-10-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2304-8-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2304-16-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads