cycbot | 38c0c533a1317ee769a557d05e93c8712b697f9020f987018c4e616521623d92

General

Target

JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe
Size

159KB
MD5

312a6c4f5763ba15b236decc331d6988
SHA1

2b7ed6c89288011c05fc01437829ae4db407c2ea
SHA256

38c0c533a1317ee769a557d05e93c8712b697f9020f987018c4e616521623d92
SHA512

d60645a628e1f599d4cf27e1fa8fb588a059ea0e0472e864368d4e66398905f7794c162ded6900efa04f10c0b8917642380f500bb2450870688a94013a3b186c
SSDEEP

3072:gFMjxQhxQiScAa2Rj9YU1LvQis4LxELX2902fJGbo3VFIe3/k/0ws:g4Khqiv0RrhQaUsbJGM3VFI+

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2820-9-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2124-20-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/1648-80-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2124-81-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2124-188-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2124-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2820-8-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2820-9-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2124-20-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1648-79-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1648-80-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2124-81-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2124-188-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2820	2124	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe	30
PID 2124 wrote to memory of 2820	2124	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe	30
PID 2124 wrote to memory of 2820	2124	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe	30
PID 2124 wrote to memory of 2820	2124	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe	30
PID 2124 wrote to memory of 1648	2124	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe	32
PID 2124 wrote to memory of 1648	2124	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe	32
PID 2124 wrote to memory of 1648	2124	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe	32
PID 2124 wrote to memory of 1648	2124	JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_312a6c4f5763ba15b236decc331d6988.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4BF9.441

Filesize
297B

MD5
178366b6d5b755d5ca5306e75034409f

SHA1
c7264c69fd2ee81f173ea90063782d3c877297ae

SHA256
1dd7b02f0b6046780c78abe758cb9834e78cefc9f281a980d6e6138b11735d29

SHA512
ff49b5ca7efecce32a39e4a8d392710deb108dd2a09439707b796cf8cfd3de38d5cc782c5790fe3d7d5f228ed65f02343372278f84fb0f1c7941ba909ddec026

Download Submit
C:\Users\Admin\AppData\Roaming\4BF9.441

Filesize
1KB

MD5
1fffd89974ecd0315d1900c9500c3dea

SHA1
abab42498cd13d17a498c7f99734e1b75243fbee

SHA256
962dba4de5bc711d467773b4a465a7c49517bdde85c252db2f3baa4f8e4d463d

SHA512
d59e4d6afc0905360c9cff64dc9583a109f766e0e42142439d6f58bd22c82d522142703922bb1040a68ad313e6f93592afd1bfa59b3cb27ec49dc29ef9520ea4

Download Submit
C:\Users\Admin\AppData\Roaming\4BF9.441

Filesize
1KB

MD5
3346142cde18a56c106bfe30e2171530

SHA1
27b8b220003b8376da05a6d88df31e1166439eb2

SHA256
2bfc3d37d8a4c530d84c0487174c6b3fe9d45baaff863e773f75d1bcf001db51

SHA512
ab2d05857ffe789e4bf301d5594c9071c0f641e6ae0002af3ac49b7d8a6ec0a766076ed1eb16715bba4dd1ab7836947afb43e169bb13eceba1653194d5e3c773

Download Submit
C:\Users\Admin\AppData\Roaming\4BF9.441

Filesize
897B

MD5
bccbe8c1e404b2144dc20a215ec15cec

SHA1
b473efb9bb0eaad492152bd1c30267f98891fd16

SHA256
b16ec77087a594b71f45c3ae776cb20e495234cbc069d40e26de273e1b2dfd1e

SHA512
4a2915708e35ead346305a911042c252028ede940bf28c908253054ef42ada7dc4abf685c9d6087ebc5d5cbb6f6b357f49159791204c0b95855d428765f3fa8c

Download Submit
C:\Users\Admin\AppData\Roaming\4BF9.441

Filesize
1KB

MD5
6e40a759d858e31c134b2525c083ef2d

SHA1
5408a48f2c45c1b6efa3bae3b6cedf23aeec88d2

SHA256
a594b22f73fca91e17ca8ce58d325d9066365a7e5ada46411f1a4f6e8c427162

SHA512
48c6a227cff591e9d47173d76e428fdc6875774d5df3db07a2f9724ba77ec6bd22f2675264aec96635d46dc6499e7f5b1779bc4748eb2bd6c963316044e6cc92

Download Submit
memory/1648-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1648-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2124-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2124-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2124-81-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2124-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2124-188-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2820-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2820-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2820-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads