cycbot | ab8ae3f81ab6fa029c068e1981309093c0bca644e6fa548432a53b4bda3ac3f7

General

Target

JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe
Size

204KB
MD5

282fea2c5f3de37737453bf71596ffc8
SHA1

23ca5008bed1269e76cfa593c72738a40dcfa0d9
SHA256

ab8ae3f81ab6fa029c068e1981309093c0bca644e6fa548432a53b4bda3ac3f7
SHA512

b57219172a381480255cb741a81eb2ec88534bec42a08153fb20860c1f7b52532ab4988cbaaddf087e51791c4fff3373e257a0847a2305bb27d438ccbeb5c018
SSDEEP

6144:e8/RFXojmWSM8RACSu3Hh7tEvE0J5RF+yiueSd3c:e8/rXoaWSqAHlCsOp+Xuvd3

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/704-6-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2208-15-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2208-76-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2940-78-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2208-80-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2208-176-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2208-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/704-5-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/704-6-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2208-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2208-76-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2940-79-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2940-78-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2208-80-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2208-176-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 704	2208	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe	31
PID 2208 wrote to memory of 704	2208	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe	31
PID 2208 wrote to memory of 704	2208	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe	31
PID 2208 wrote to memory of 704	2208	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe	31
PID 2208 wrote to memory of 2940	2208	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe	33
PID 2208 wrote to memory of 2940	2208	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe	33
PID 2208 wrote to memory of 2940	2208	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe	33
PID 2208 wrote to memory of 2940	2208	JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:704
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_282fea2c5f3de37737453bf71596ffc8.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C4AD.315

Filesize
1KB

MD5
b82986a69fe59a2947b7b5d7792ef2e9

SHA1
fe250c693ddb5f55b3f3db7fae89a2479c2ed97c

SHA256
e0f7135161d56bac67575f21cb78812d4b7e1cb0d306db84dfeb84a5197cd2f3

SHA512
cbf70085115f4a880262882d4d21de7f4a483a307767c11a1adc5ed74b130ec22c59bd5e88e8b001b98ed902fdf0ad91d07530e47c82da60af5243c95656351c

Download Submit
C:\Users\Admin\AppData\Roaming\C4AD.315

Filesize
600B

MD5
545840155184b5856b769d64edc35eda

SHA1
3e425d188294603b1ac925026f7c20bfa6e0f02a

SHA256
d4b956e9e506373768a8cca0eda382b253350fca9d92b4a7b004cdaf52bd218b

SHA512
7aa11efeda2171b29e298e54dac69c554fe3305c40c264a3aadc2cf5743b5e83af148127cb59e189ed615a5fd583a801c24f0c39fa846b59acacd96617009258

Download Submit
C:\Users\Admin\AppData\Roaming\C4AD.315

Filesize
996B

MD5
efb58db6a14f9c2bb05db3e4a44ab4c9

SHA1
4c26dccfb7d5377f26bddcccb8810f4f32e97598

SHA256
85d698ef82febddc6b61d2662a044d6a04ca1430e980730137d59d5693182ba3

SHA512
3144a030073fb3be1840965f656026f66fc46f8cd6a699a64141d52136d937427713f8db86e1932f87683978f99e3020be83d48237dbb14dd0fa05bb19bc54b4

Download Submit
memory/704-6-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/704-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2208-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2208-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2208-76-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2208-80-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2208-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2208-176-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2940-79-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2940-78-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads