cycbot | 4dfc6e0d2d8a98696fe29362368b33be77d29937891ea3095814af81a384bfd7

General

Target

JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe
Size

159KB
MD5

dd295f9bb998687bfe58fc3bcc700ae9
SHA1

1500830394c5f42dc0765306986f21046051eb99
SHA256

4dfc6e0d2d8a98696fe29362368b33be77d29937891ea3095814af81a384bfd7
SHA512

3623bb54c2a1efdfa85047d0206bc0b72ff57859880f6f46b13183f55afa8e3072e492cc76410c1d9009e24f2cc59239e97653ab8720a2714a479bbd7b0960eb
SSDEEP

3072:G5ptwmmL29pvLYcgX1SFcuKQ6hJDNF+CZ4l7l2Jj4vDw6PDdGqp2R981Up7D4QuR:4ptmLM5m1OcnQOId7ncgDl+P

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2260-6-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2260-7-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2236-15-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2228-80-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2236-81-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2236-198-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2260-6-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2260-5-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2260-7-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2236-15-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2228-78-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2228-80-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2236-81-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2236-198-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2260	2236	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe	29
PID 2236 wrote to memory of 2260	2236	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe	29
PID 2236 wrote to memory of 2260	2236	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe	29
PID 2236 wrote to memory of 2260	2236	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe	29
PID 2236 wrote to memory of 2228	2236	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe	31
PID 2236 wrote to memory of 2228	2236	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe	31
PID 2236 wrote to memory of 2228	2236	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe	31
PID 2236 wrote to memory of 2228	2236	JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2260
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd295f9bb998687bfe58fc3bcc700ae9.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BEAD.D52

Filesize
1KB

MD5
03d62174b643a3d5775d28417d1dab21

SHA1
1ed7a7cce4c5f0600dfca402ff75fd15deb54eaf

SHA256
530f4a72fb4a8e65a6d363c552da14de05e6cd15747461be4f6f5d5a181d6286

SHA512
82af8c481f8a7f73a68ee9b3eb8789908b4eff746f98e03120278ce74d7a242c1f2ae1fde31f157b9228a15cec9b9aeb36e1fd0cb815a8e15d948efa6173ee4e

Download Submit
C:\Users\Admin\AppData\Roaming\BEAD.D52

Filesize
1KB

MD5
2bce0def4a56f6f0268967f95d00213a

SHA1
f997a40bd6eea2a51b7b2c0a6e5698627f9e6ad8

SHA256
495950ff236b5d65e74d9f38914d18f3cea80891f2b87762bb515fc29a241700

SHA512
e17d3d3ba309b88683d784599fbe3bc50ca626a2b96f687959e3b54c7997c664b41b6debc547f0adc3b12fc734d14c97c30c6894e467357cfb5e4a77166d58c1

Download Submit
C:\Users\Admin\AppData\Roaming\BEAD.D52

Filesize
600B

MD5
4a3302a95e1dfd1e2c1b995031598fcc

SHA1
945ece6968db186b216322bc777d82f71a31d6b8

SHA256
cdbed26f7f1468dcd2e213d7d6865f66864270c4bbc58e4f95c28067a5ec4e4a

SHA512
da304b50b59ebb290e3d5bd6179495892c35ad79cbc9ce9b9dc06d32f56428625b279d7add54243e94b9ffa32133b16ec46e290383de17a2a30701c24de41a3b

Download Submit
C:\Users\Admin\AppData\Roaming\BEAD.D52

Filesize
996B

MD5
6b8c23e0827b342e8e41c6998b76e977

SHA1
72922e21e6d7d95ea1ac26820d9ecb46bb577ad1

SHA256
320fd811f3a696cd6ffa86ab05f116bad48fda5d928d561a821a31bd1c24b2cc

SHA512
7d3e63d678569f8deff63602ea54011c9eecc6b732e5de7cfa0fa910338b8df12c3fbbbde76bdc3b7ae732a827aff04df6d3d586072e097e743c9168bca18142

Download Submit
memory/2228-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2228-78-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-81-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-198-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2260-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2260-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2260-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads