cycbot | d9b256faf828ea5585227841cfe8d384774fbac5e5e55b0dad5125d3af86e9ed

General

Target

JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe
Size

204KB
MD5

25450849d2cf016dcdda97abeae2288b
SHA1

7db9882a46173d7c61b88ef741e5dfd280f74ed5
SHA256

d9b256faf828ea5585227841cfe8d384774fbac5e5e55b0dad5125d3af86e9ed
SHA512

9d159f57a3d24d268b5d49652294f9fbc87e5ad935651987cb5ba21694964d9ea78a8eb49dbbf3310a8fe0f2e9805e2488d49b2d32f63c83d44dd5b76a27e41a
SSDEEP

3072:njAqi+TogitjfCqObAjYxxNO9WYSRTFDDr7oA3qZ8PoIW2j6e:njAtbljO0jyNvFDMA3qKoLe

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2720-8-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1840-16-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1840-73-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/2104-76-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1840-147-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1840-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2720-8-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2720-7-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1840-16-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1840-73-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2104-75-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2104-76-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1840-147-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2720	1840	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe	31
PID 1840 wrote to memory of 2720	1840	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe	31
PID 1840 wrote to memory of 2720	1840	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe	31
PID 1840 wrote to memory of 2720	1840	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe	31
PID 1840 wrote to memory of 2104	1840	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe	33
PID 1840 wrote to memory of 2104	1840	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe	33
PID 1840 wrote to memory of 2104	1840	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe	33
PID 1840 wrote to memory of 2104	1840	JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25450849d2cf016dcdda97abeae2288b.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0BFA.D80

Filesize
1KB

MD5
1455578bb493c1f3f736a6640986310c

SHA1
3f78d22dc2f51b121b66e371fb86c72d84b8dc09

SHA256
10d37940cc2e449588033973c0d45267e347481fb8f0771d6ae90a4049f58700

SHA512
17d4ee254f8385bd10dff01e27ed00d95b969264637f54ef5aa09282b3496539aa313ec469d2cad9c939e2a7e8631602c0790d9e108ca6b1ba64000fa942ce01

Download Submit
C:\Users\Admin\AppData\Roaming\0BFA.D80

Filesize
600B

MD5
5303e592c5151b5d4f46d1d99427109f

SHA1
40f0049cc5b46496415da3b8479c362da366b2dc

SHA256
9ea638aec418c00775cf0999e2d80e68511433a8e7ad7d5d13dc19620898da3f

SHA512
095df125aed6dda076535df14017bdcb9e30ce0fdd4223d6fa82e33cab732cc8a38bddb417919516a6f8ce64f376402a861eeee1bfe4afa96e8c4cf2715654a8

Download Submit
C:\Users\Admin\AppData\Roaming\0BFA.D80

Filesize
996B

MD5
2f34c83c62472afc703135e3e1f79b9d

SHA1
d4fc495e2aa1b6cef47b05ae46c968457ce14eee

SHA256
68967b81d5ebf6509f1666aae084986f68469385a7b77b744269de604f95b2de

SHA512
710982308f1039040d661337d8a6476fc854cae9343f84471fab432a2a396bee49fbaf68fce284c6715eeb4a96eb81950aa14eac66b95b44bd97d2c6abf1c1ed

Download Submit
memory/1840-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1840-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1840-147-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1840-16-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1840-73-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2104-76-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2104-75-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2720-7-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2720-8-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2720-5-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads