cycbot | 4f6188d041314817037c4186d3977772baab56c44ed61386eda548e06c0bbd94

General

Target

JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe
Size

172KB
MD5

e0ad754319950b72a2e7c64cf7dff51c
SHA1

2175101172b921e4f8b81c3a88a34f5e0129a52b
SHA256

4f6188d041314817037c4186d3977772baab56c44ed61386eda548e06c0bbd94
SHA512

955239ca7b8b8044a1da8e4b3546462580de61b807bd056e206f13a95a2d7fda4bd02e18e948c85bfe172fed3aa4b0b9e93a7aad51fb4f509a860e053edcc501
SSDEEP

3072:kTMtbbgSjKJ6AFwHLjokluE0PXyvOmHb1lDsTGZ9IBXzTZtmpkxJJrJJ5rldjx:gM9jG6AFwHwYSXyvOmHploSZmD1tmifn

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2660-5-0x0000000000400000-0x0000000000441000-memory.dmp	family_cycbot
behavioral1/memory/2744-12-0x0000000000400000-0x0000000000441000-memory.dmp	family_cycbot
behavioral1/memory/2400-79-0x0000000000400000-0x0000000000441000-memory.dmp	family_cycbot
behavioral1/memory/2744-80-0x0000000000400000-0x0000000000441000-memory.dmp	family_cycbot
behavioral1/memory/2744-177-0x0000000000400000-0x0000000000441000-memory.dmp	family_cycbot
behavioral1/memory/2744-212-0x0000000000400000-0x0000000000441000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2744-2-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2660-5-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2744-12-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2400-78-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2400-79-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2744-80-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2744-177-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2744-212-0x0000000000400000-0x0000000000441000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2660	2744	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe	31
PID 2744 wrote to memory of 2660	2744	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe	31
PID 2744 wrote to memory of 2660	2744	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe	31
PID 2744 wrote to memory of 2660	2744	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe	31
PID 2744 wrote to memory of 2400	2744	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe	33
PID 2744 wrote to memory of 2400	2744	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe	33
PID 2744 wrote to memory of 2400	2744	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe	33
PID 2744 wrote to memory of 2400	2744	JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e0ad754319950b72a2e7c64cf7dff51c.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AAB0.B6B

Filesize
1KB

MD5
067f605aa3e5a6ca66db0ee8c0984707

SHA1
b83d14adebb1e7008f7ce1117f05e9c711e68ab6

SHA256
a0e923db09349b796fc1f0cb46642cf59b0cfbbeb0b3dd7f8c05f2c381601699

SHA512
91246595dfdb14f15be648c130c33ec7f362464c8412abfe6bd0ebd3b43a0dcce8354929a13ce27d617eab129ca76ef32f99691062f4bbb793203f509f1359e5

Download Submit
C:\Users\Admin\AppData\Roaming\AAB0.B6B

Filesize
600B

MD5
423cffc6711d3c8351af665751937557

SHA1
3cdd640720a7d01ffa920a464bcd6abacb1eeb5a

SHA256
e5d3e0d40cf89c28d076b0ac66842357833f074deedda218aee986235cf249b0

SHA512
99f0e82326b9fb694bcec4115b396a2380a49ce1b58d7534e80507ab07b2dfae676fdbefae10538921ad11d5e92fedf942594fa3af47137d2b3c443ccbc8771b

Download Submit
C:\Users\Admin\AppData\Roaming\AAB0.B6B

Filesize
996B

MD5
cd3022d469cc1ad669c15d952f420bca

SHA1
bc62735643d01e10c0801f3a90ea81aae52db73b

SHA256
15338ab3fd7bae0e2352904c348bf02b4e3d4a5defdf916a927fc6f4cd8ebd68

SHA512
6e2a3bd66abb8a39838b0e4ef7638d90291eda75ac994e7b88c9c8fe99dd689da412e92bdbe1cff528261c96899286aeb997e5dc16d653f4be851c71535a653d

Download Submit
memory/2400-78-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2400-79-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2660-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-12-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-80-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-177-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-212-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads