cycbot | 0c08ffea58deb4d613a7f395153c4e73f1f009d3e8a00f4b751c9bc92eb7f664

General

Target

JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe
Size

178KB
MD5

26a6426bf35205aa4343be177708a80f
SHA1

e749dcc8b3a0fc5f8a30bce13564cd486b94b07e
SHA256

0c08ffea58deb4d613a7f395153c4e73f1f009d3e8a00f4b751c9bc92eb7f664
SHA512

8a3b76c79dac8b1484c551afe85858169dea0428f295eb2f1f30b366b117abdb606e1a40439317f7165b6bc6fe4722069fc5f6561eddae61b3736824bbf2df11
SSDEEP

3072:p5JCHBSS9NNPFA6Lr4MHFr+3ZvWyf1K98qD5sBlAkAz8tAFwknPKtZU:pISI3Fn0Mlr+JKKUuLrBdkPKtZU

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4148-13-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral2/memory/2464-14-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral2/memory/2464-73-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral2/memory/3664-77-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral2/memory/2464-183-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2464-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/4148-13-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/2464-14-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/2464-73-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/3664-75-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/3664-77-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/2464-183-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4148	2464	JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe	83
PID 2464 wrote to memory of 4148	2464	JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe	83
PID 2464 wrote to memory of 4148	2464	JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe	83
PID 2464 wrote to memory of 3664	2464	JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe	85
PID 2464 wrote to memory of 3664	2464	JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe	85
PID 2464 wrote to memory of 3664	2464	JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe	85

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:4148
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26a6426bf35205aa4343be177708a80f.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C9E8.8AA

Filesize
1KB

MD5
07a70df37ebe2a2f39832f04b05550c9

SHA1
adb0042734608379342ad22cca5fca2e9d1c3151

SHA256
b2f742bd870aa129ab3d7a99035a9b1dd2c26b5e15d521657ad6b608688a751c

SHA512
25b7acc2bdb6b3855c71870a786bed1833cf1038fb8854d50eb2d37a86f7dc5f0825807dc1ab1ef90baf2db8699bc80e4b0e95f63008d3bed238f007e6e8e5de

Download Submit
C:\Users\Admin\AppData\Roaming\C9E8.8AA

Filesize
600B

MD5
ef7151c6417ca69b1a75f0985dc9edef

SHA1
fd0bf0c74b6087bd60d3a63025b3a2b7cc9d11ea

SHA256
c58d961d6d0f2ce7be74d7e6d3e9570fe4f3c0bc52b90973c353ba05802a72ca

SHA512
71937ebde2bb4d4b6cc59816e1e4ad69c0dc6c4ea5a04b2cf56f30dcbf3d1787c8c981a2a3fc4ac227a63ed65101997fbc5707709da38310847b8c22a21eab8e

Download Submit
C:\Users\Admin\AppData\Roaming\C9E8.8AA

Filesize
996B

MD5
89fdfa8e626abece72f39216dd05f5e6

SHA1
fb7a9fa0673d871266f43f85424fb3eaa5e11fbe

SHA256
b1c945f280d41b2aa0bea451017d9ababaf471e90cea49ba3d45e8dc8845d08a

SHA512
6497b26633a43a3dc49bfd1055c81ba01c7b5e76f99f8deccef0cab466c1686a7940409b78582085e32402cc167718c63e153d026c79ca5814031beb3e07d9b8

Download Submit
memory/2464-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2464-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2464-14-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2464-73-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2464-183-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3664-75-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3664-77-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4148-13-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads