cycbot | 9cc81930049966f8bb3e904d31ee7d02e4ed16b28b2ac8f36f4b8a07c37af19b

General

Target

JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe
Size

191KB
MD5

bccfd3da9ad7b5d7626f8aca5858ab92
SHA1

1069027bfac1e999a6bca89c8591dda559d376a9
SHA256

9cc81930049966f8bb3e904d31ee7d02e4ed16b28b2ac8f36f4b8a07c37af19b
SHA512

1ba10730705ff6793517b55c9551096491c11493880acf14bb6477a3b9b1ba435f58b6de84bfe159d14d6cf59e7941c1d3d4bb6dac3ae2420b4ce4f2a2f75139
SSDEEP

3072:CQjblh10LCvYbZkXxIkE9lseNugkXvs/mJDjIOJGhC21TgKnO:CQjBh10LCvYNBkE9KeNLk/nWEq

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1456-14-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/2116-15-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1084-85-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/1084-83-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/2116-86-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral1/memory/2116-185-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2116-2-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1456-12-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1456-14-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2116-15-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1456-81-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1084-85-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1084-83-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2116-86-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/2116-185-0x0000000000400000-0x0000000000490000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1456	2116	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe	30
PID 2116 wrote to memory of 1456	2116	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe	30
PID 2116 wrote to memory of 1456	2116	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe	30
PID 2116 wrote to memory of 1456	2116	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe	30
PID 2116 wrote to memory of 1084	2116	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe	32
PID 2116 wrote to memory of 1084	2116	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe	32
PID 2116 wrote to memory of 1084	2116	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe	32
PID 2116 wrote to memory of 1084	2116	JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:1456
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\3CB6.ED9

Filesize
1KB

MD5
bf2cd3bc918969db049c1ba2ef6dc066

SHA1
ae451a189ea65f88157ba3bea081821cea62b4d6

SHA256
6aa9f0881cf9da55b40220fe3a43563f5afa299417babc0bd2f87dca3875f0ac

SHA512
76119bdf4a79762d6ac1903d450efc8115b78d812b8bb71e8c8e763a73ad8d1169ca371668f6eb60050c164cc442695d38ee321c1d9192a47de2bb4e9bf7d6a8

Download Submit
C:\Users\Admin\AppData\Roaming\3CB6.ED9

Filesize
600B

MD5
b55bcd4b3e9b61934ffca4df8d5d0524

SHA1
b65f61526c9073e0bda2c0a7d2342986ae7b6826

SHA256
96f1e6aaea424a770341483869695e79834aadad9382a428b36779c37211f48f

SHA512
c97d282f99aca0ff879d2f27d366ebe677b6acee9024960f63447e97c45bbe907f76212f7cecae45f62e65268c30e1122cab0ecc35c96d20022cabfc4efa2dd6

Download Submit
C:\Users\Admin\AppData\Roaming\3CB6.ED9

Filesize
996B

MD5
9c9717f5a0fee780b5d84094f7873198

SHA1
078adf86687abfab8afcb7dbb0b6129046f41602

SHA256
22baba240f78c79edc39c2f14de87a48229f8128bf95f6f1f4cc58bf388b0b90

SHA512
ff62aa49d303c0c0c6ac33279aa4d0f171a4761371c79d702912ad03cf558c9fc6a0acdc68fc3bd572497d9e62b92487973e04f13bee7ea8582681f679e47e87

Download Submit
memory/1084-83-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1084-85-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1456-81-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1456-14-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1456-12-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2116-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2116-15-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2116-86-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2116-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2116-185-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads