cycbot | 7890809eba55bba024979ed3d6705a775f8220d7963fba9c8906dafbbe7faf52

General

Target

JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe
Size

178KB
MD5

c8cc657d5b2f5a6737635342f82ef4ad
SHA1

e6acebcfc8c16c84f0a7d7b301e9aaf215f312ec
SHA256

7890809eba55bba024979ed3d6705a775f8220d7963fba9c8906dafbbe7faf52
SHA512

ea3abcdd0cec56f6a41178bebc9328222e28ad8d8601295d9f6ba0b21216c21061a20cca2a108552290501d28e0849cc34cb56d505251f96b4887431120cef58
SSDEEP

3072:3vTe4ucH1Bva4KYN+PQWo1HSpd6/JmWgCmABVJDGYgt4gQl7d6QR:CncH1c80YYopmADJDbgOgQl7IQR

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1148-8-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2456-15-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/652-70-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2456-71-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2456-162-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2456-199-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2456-2-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1148-6-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1148-8-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2456-15-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/652-69-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/652-70-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2456-71-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2456-162-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2456-199-0x0000000000400000-0x0000000000466000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1148	2456	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe	31
PID 2456 wrote to memory of 1148	2456	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe	31
PID 2456 wrote to memory of 1148	2456	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe	31
PID 2456 wrote to memory of 1148	2456	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe	31
PID 2456 wrote to memory of 652	2456	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe	33
PID 2456 wrote to memory of 652	2456	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe	33
PID 2456 wrote to memory of 652	2456	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe	33
PID 2456 wrote to memory of 652	2456	JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\08E6.FAB

Filesize
1KB

MD5
ff3bdbcb5b20e81b91e3f53c82974da5

SHA1
42a9be7b206a01d5b3a1ace106261b877ea665f1

SHA256
714b41f4383c52c0a04139af539644dbe733968fc08b0a1d08e2c711c3e0df3b

SHA512
fc10c2101b1652dfcc8517b8116f8b5b60747e59e60fffc7c29789ceedf9e04a401ff665faac80f4e7b08d9947ceae58b70c27dae8e931594dcae7a4da5ddf76

Download Submit
C:\Users\Admin\AppData\Roaming\08E6.FAB

Filesize
600B

MD5
f2e83637cf5cc7ece8f9fd6549ee55bd

SHA1
ccc835d8c878b01312eaf9a62d09df7a4f4f8687

SHA256
d10186dbe8eafd3017e6a91c0910c1715806deba2de2121155abde95ef539c28

SHA512
0d165ff9f12fff4d864b786017c32f6259eb87e1c1f82439eda8640fa576274328e4c933360ea8097b490e6257bcb992120f9e21f2528e1d6a6bcc138ba6880c

Download Submit
C:\Users\Admin\AppData\Roaming\08E6.FAB

Filesize
996B

MD5
d7e110f70929e4adde3b25f121a14f28

SHA1
5c0df7e5ff8647c37682fb79369b879605af26ef

SHA256
c408caefd95ca532b77c78774eb0968d0ba3efe8eb054a6810a0076bb5fffa61

SHA512
5bbd90a6a7e9e4fe7354412cf11ce354f9d34266d2b1624ae5127a0a6924ca1c6d35627c7cabe720191ea5e915bb81fb41615f1593a092308f68e1224a48abd2

Download Submit
memory/652-70-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/652-69-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1148-6-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1148-8-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1148-5-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-15-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-71-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-162-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-199-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads