cycbot | 9b470c80e4e68217a5b3efe2e6bb3d34d988b1fcaa34105e4b7ae5b1006e4557

General

Target

JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe
Size

165KB
MD5

2523464fb225cad5bfec48c4a53c5bd3
SHA1

bb6909667ecea674fc111ee1e4033c4db5b9ad75
SHA256

9b470c80e4e68217a5b3efe2e6bb3d34d988b1fcaa34105e4b7ae5b1006e4557
SHA512

75d21ee592b84e2d4989f142dfa78f25b2fccf862323dcb1c34c2f015e1e00fbafd6564daf81ee86ea498ffcebc4a568a87c95d8c40b799c041c6a45cce7ed75
SSDEEP

3072:YvSPEflpaJPK6ZNWpfTuLGTg8M86qSyUujoBVbFNpFrKvpTI:+SPEflcPjSpKLtsJjyVbFNmx

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2592-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1128-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1128-17-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/888-116-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1128-117-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1128-287-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\25F23\\6212A.exe"	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1128-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2592-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2592-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1128-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1128-17-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/888-114-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/888-116-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1128-117-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1128-287-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2592	1128	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe	30
PID 1128 wrote to memory of 2592	1128	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe	30
PID 1128 wrote to memory of 2592	1128	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe	30
PID 1128 wrote to memory of 2592	1128	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe	30
PID 1128 wrote to memory of 888	1128	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe	33
PID 1128 wrote to memory of 888	1128	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe	33
PID 1128 wrote to memory of 888	1128	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe	33
PID 1128 wrote to memory of 888	1128	JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe startC:\Program Files (x86)\LP\2A92\BE0.exe%C:\Program Files (x86)\LP\2A92
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2523464fb225cad5bfec48c4a53c5bd3.exe startC:\Program Files (x86)\23892\lvvm.exe%C:\Program Files (x86)\23892
  2⤵
  - System Location Discovery: System Language Discovery
  PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\25F23\3892.5F2

Filesize
996B

MD5
76fe05d6d116a1f34de787f259b86877

SHA1
d312404bf7f0752c9cb7adcb4d6620cca4ed1075

SHA256
7317d32a084785f98b330ad32fa400d5cd9145849df3b933437bf180485a393a

SHA512
c8d897300ec97ca52539b7643cc5f410b23e96db23b417a56cc9579354350037969a4ba92e44b0f54bcb5fb57497d2d5b61841e55460d86eda9bf100dcd9e59a

Download Submit
C:\Users\Admin\AppData\Roaming\25F23\3892.5F2

Filesize
600B

MD5
d8a83e0bbb24b7014370e5f0baa2c3d8

SHA1
7120a8cfdc76e4e3af62dad4830bb6d00d12658b

SHA256
77e0adbbf39aac8945dd21403ad9a71b22435e372aa53d87f7b0dc0934376d1e

SHA512
5659ade36f93bbcc1f966cd33f5eceb64d71882b1c058fee04bef68561d7e587800bdbe9d1446028ef9d086877a732970f4243f145bb886d86c13fd54e9b53b7

Download Submit
C:\Users\Admin\AppData\Roaming\25F23\3892.5F2

Filesize
1KB

MD5
ad675d6a95892eb92832adb2d5190f8b

SHA1
17d4e0ea52c2865381d96671a103dded025e0289

SHA256
c029a406c4e223ba7a07ebdd671f8161aa8e3c884e01f7521782fd6333f07437

SHA512
fe740ee381911bf39b307c534a76c6f2efa9d23141d13185b7a5e5e439fc99b3ac53ff3bbf791072aa1ea8ec7f57da0d39abba4541ae36ef7b3bb71d150e17e8

Download Submit
memory/888-116-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/888-114-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1128-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1128-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1128-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1128-117-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1128-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1128-287-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2592-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2592-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2592-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads