cycbot | 6f6445a629c8fff724d2a1ad61a5487011308f2b3a72236072d45026f34bcc09

General

Target

JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
Size

220KB
MD5

ba1947b8d4ec4a6cb8374931160827da
SHA1

dd1f286416aa3896d6318f5048147cb8cfe73dda
SHA256

6f6445a629c8fff724d2a1ad61a5487011308f2b3a72236072d45026f34bcc09
SHA512

8dd2badfe8e3dea12f15b9e2d8278c4227ff2a4be028e8cf6e141e602205ae014b5709fc14a2a03808396df263899f6a144815fa277bc7df5f646a45f5fa0702
SSDEEP

6144:lwkwJej1coHvEf1e2a16Po3u0q3dM5KxSW3Y:Fke5coHYQ2k6fX

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1376-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2576-15-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2576-78-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1640-81-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2576-183-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process
PID 2576 set thread context of 0	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
PID 1376 set thread context of 0	1376	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
PID 1640 set thread context of 0	1640	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2576-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1376-6-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1376-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2576-15-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2576-78-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1640-80-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1640-81-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2576-183-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1376	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe	29
PID 2576 wrote to memory of 1376	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe	29
PID 2576 wrote to memory of 1376	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe	29
PID 2576 wrote to memory of 1376	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe	29
PID 2576 wrote to memory of 1640	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe	31
PID 2576 wrote to memory of 1640	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe	31
PID 2576 wrote to memory of 1640	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe	31
PID 2576 wrote to memory of 1640	2576	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1376
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E516.411

Filesize
1KB

MD5
d38825212c0441242869b2df6fba24cc

SHA1
0abe068fe3bd68bd3b02f5d2572290eea773ca2d

SHA256
17c96a7e4e8212548f4b80353c080394a0f2fe562619c87d1cd0265a3e84a7f7

SHA512
9f04ce088e71ae0c15799af56dead371d7ef5dcfc25a4c1f24c7a8c00ce499b1b341626b13ba7a0ab03122aa82b3994609d204826fa22fed6253d560421ede67

Download Submit
C:\Users\Admin\AppData\Roaming\E516.411

Filesize
600B

MD5
03f6857d22da019a5df00c857298dbe2

SHA1
b1881ab4753857871197e293c9e56f918dbb6b21

SHA256
06f1ddcb107ba341c95331fb0181db1070c4a8fce4d1859c89e436f86204e813

SHA512
5a89c5a41fb624573e66e378c1dcbc55f196c6df573d9ba72b331818eec3550afcfe99492e053d6921ccd4adf44721a345891f6ba6c60ef0dcde6e526c0ac9fe

Download Submit
C:\Users\Admin\AppData\Roaming\E516.411

Filesize
996B

MD5
e4454da89e758808481c44455e8e8312

SHA1
cf6c4b1eba4f90a45b988f64d712d58308fcf45f

SHA256
743f1f9796f5f0f3656a25157f446d6f026886df3f1a88306dae15a9bdc10e5b

SHA512
5ba0eed69c4f25a5da57f695951604273ee0508ff58b72def01a2ea80296ab9fddb3ed339cabc719e4224bd6771a571eeb769387b5d62941d82b49042d1769be

Download Submit
memory/1376-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1376-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1640-80-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1640-81-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-15-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-78-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-183-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads