cycbot | 18b9065b232496695fd20a276d2dba66c7b447f51ff39b89533a0593c68b6695

General

Target

JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe
Size

165KB
MD5

c4811f33bb31bc4384c3752163fa490a
SHA1

ec2f433936d6754c95ad44a0314fd7e2b65e47d8
SHA256

18b9065b232496695fd20a276d2dba66c7b447f51ff39b89533a0593c68b6695
SHA512

d6d845d96f32dd98d1fe332d12c0655bc3630dbe4d7cdda5c15ac1b9e01e01d6651a5f22a3a5ea218ac454db7e41abe2adf2c1a5927ec5f17af8ad2b3c6287a0
SSDEEP

3072:l7nHIPOh6A3TGMdiK0W3EaYB5T9QNFFWXK1LH3dZkAR894kEoYQ9Y:lLHZ6AjGMdiK0WUJoYa1Lnkgv3oYq

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2860-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2720-17-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2720-18-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/316-137-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/316-138-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2720-139-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2720-301-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\DEDD3\\E4023.exe"	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2720-3-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2860-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2860-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2860-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2720-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2720-18-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/316-137-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/316-138-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2720-139-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2720-301-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2860	2720	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe	31
PID 2720 wrote to memory of 2860	2720	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe	31
PID 2720 wrote to memory of 2860	2720	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe	31
PID 2720 wrote to memory of 2860	2720	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe	31
PID 2720 wrote to memory of 316	2720	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe	33
PID 2720 wrote to memory of 316	2720	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe	33
PID 2720 wrote to memory of 316	2720	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe	33
PID 2720 wrote to memory of 316	2720	JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe startC:\Program Files (x86)\LP\231D\933.exe%C:\Program Files (x86)\LP\231D
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4811f33bb31bc4384c3752163fa490a.exe startC:\Program Files (x86)\D34D8\lvvm.exe%C:\Program Files (x86)\D34D8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DEDD3\34D8.EDD

Filesize
996B

MD5
c66151e5c39d1cec6210c53f5b21824e

SHA1
ed209b8a8374f2232cfcbeb1b51fd86ec3cdfd28

SHA256
66a7576f6e7091d0429b1c40ea6d2a5b4b5086d6ee3c67d98adea727a2fd4de9

SHA512
83c328256f587b6fd880f344980d69253b81d563acda59a4656c83f09b1630290a0695ec9fb11302a3148eaec5ce5dd596b3e0cdb1064a78ee16627d1ce889ef

Download Submit
C:\Users\Admin\AppData\Roaming\DEDD3\34D8.EDD

Filesize
600B

MD5
51c1a3e45323304f2b9e757e28538a84

SHA1
d37187ee30fe847219416fbdbb2c401336e53005

SHA256
a68fef8a4bc9a0acc1747bd6bcf918ebdafbf5be5506084b9fe0c8691b6df807

SHA512
d921a7f0f1589f2792b00d4086eae3dcf391b6cdaf8554ca5fbcd23e0669a1e57b30146cf5a2ac242f63cab22ee97fb7cbcf3c402386fe752ce7728ba9944168

Download Submit
C:\Users\Admin\AppData\Roaming\DEDD3\34D8.EDD

Filesize
1KB

MD5
aca249c12fb3932bd0c2535c06e3e06a

SHA1
d46212ab313e157b5892064ce4e889795631fe54

SHA256
e668dc135c8197f54e004b47987751416eb42477f3b60edc765dfc2c03a02b79

SHA512
af2d7ff59b50a6c19e8408f33c28f4804d8bb6dd6bddbfc5e7d17af03c7096c848cb387a8f31c08f2add77b732349de704cc0d272bdf1235079a47fc5d303ba3

Download Submit
memory/316-138-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/316-137-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2720-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2720-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2720-18-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2720-139-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2720-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2720-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2720-301-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2860-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2860-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2860-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads