cycbot | 1119e84f9273724575801886c1d9789315dd247b6fe26463e278abceb9d367c3

General

Target

JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe
Size

164KB
MD5

e2565a0f5f7ae250a66e32179fb71616
SHA1

65e9bd06d73be64510c66ad505e4fc24caba928e
SHA256

1119e84f9273724575801886c1d9789315dd247b6fe26463e278abceb9d367c3
SHA512

5801364d6520c9db9455bb597235dce56d2908c8333ec4547ea1c3fbe7baeefa834bae011ea9026332a10038149988658381406171e4bd86d8a9d3b99dad0d09
SSDEEP

3072:mHmjLLQw1t930Mj7dkgl2j5jd5R/myyZpDyTEeij2TguH1giWgOCbNpM:hLntt0MHdkglS5jPtaOEeij2TgwnW2

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2920-13-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2504-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2504-79-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2024-81-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2504-192-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2920-12-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2920-13-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2504-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2504-79-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2024-81-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2504-192-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2920	2504	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe	30
PID 2504 wrote to memory of 2920	2504	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe	30
PID 2504 wrote to memory of 2920	2504	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe	30
PID 2504 wrote to memory of 2920	2504	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe	30
PID 2504 wrote to memory of 2024	2504	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe	32
PID 2504 wrote to memory of 2024	2504	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe	32
PID 2504 wrote to memory of 2024	2504	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe	32
PID 2504 wrote to memory of 2024	2504	JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2565a0f5f7ae250a66e32179fb71616.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8507.EC8

Filesize
1KB

MD5
bcedf57da45865965b0c4d430090c60a

SHA1
38fdec8fe839a4324c4f3425b68bef43036862d6

SHA256
48d4a0332850f4fa560ac7ecb51d4d03cf05c227e91f366f29c5a8892630acd4

SHA512
54699d412166763e8cc7d62578b64d869e596b514a3379124e3e31e05f0d8fc52d42cc48a72f57ae09ae5fd6d107c4d23c2fff0b38fa0db72cba331701f93d2e

Download Submit
C:\Users\Admin\AppData\Roaming\8507.EC8

Filesize
600B

MD5
5eb1c36366739a51940e334001667461

SHA1
b415e115d62e52b00c512ce7d4668ba83af8c5d0

SHA256
ec67cb4e960ed094b53945a4a77b5ee27f08951d33c87df55ba7822f58d6bbb2

SHA512
48ed4973640c1ac7f77fa0e931390f6d06ad8b90823e76cdb58b2e69408cdc7962539d486030e90fed3b0f45847807f4c79f02c30a4bf46ebd53687551612392

Download Submit
C:\Users\Admin\AppData\Roaming\8507.EC8

Filesize
996B

MD5
087f9b5b11bc6d834d23b8e77e2901ba

SHA1
e3f32753d20a581e14f209b2b92f49f864db951b

SHA256
6d7db54354ac3f6bc0a62f65013beec8d2df3f48bcb5f129110237bf80f083e1

SHA512
cd450ef8c546b65c7c20979520f88755bb70100793ceeb8aa2d422acf66ac60e21a335c96f51f7e85445c2a5f80461dea6f7fa7584256a0bd2a52b4fd521c375

Download Submit
memory/2024-81-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2504-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2504-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2504-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2504-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2504-192-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2920-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2920-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads