cycbot | 906c5db5b81bb5b112ed6f3ef2d3181bb4869e82e4e3a40b775e5ecaed3264ed

General

Target

JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe
Size

173KB
MD5

3554b0cd570e8d29242b9cc31bb66fab
SHA1

f137a863bd7309896c243aa9a8a06bc70f5579d6
SHA256

906c5db5b81bb5b112ed6f3ef2d3181bb4869e82e4e3a40b775e5ecaed3264ed
SHA512

62a0e10a8df1ff48292630a04cc03105fa29fdcb6a7321d61cac911b7d2fab6554d2fabdce53f67583270264689d0499fd11b1721ae0eb1ee435508f8efcfa8a
SSDEEP

3072:02EXXq0sLf5/tUj8JxMHXKbMmQppXuNR7D0+HIldhkeFVFuf2jbU7xowAM:0j6prqQj2eN1jHIhkqW2UlD

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3164-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1320-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1320-17-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/4276-132-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1320-133-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1320-303-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\C2663\\FCE24.exe"	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1320-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3164-13-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3164-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1320-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1320-17-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4276-130-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4276-132-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1320-133-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1320-303-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 3164	1320	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe	85
PID 1320 wrote to memory of 3164	1320	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe	85
PID 1320 wrote to memory of 3164	1320	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe	85
PID 1320 wrote to memory of 4276	1320	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe	98
PID 1320 wrote to memory of 4276	1320	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe	98
PID 1320 wrote to memory of 4276	1320	JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe	98

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe startC:\Program Files (x86)\LP\24BC\C25.exe%C:\Program Files (x86)\LP\24BC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3164
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3554b0cd570e8d29242b9cc31bb66fab.exe startC:\Program Files (x86)\63B8C\lvvm.exe%C:\Program Files (x86)\63B8C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C2663\3B8C.266

Filesize
996B

MD5
8962223379f1c9635b6b39ca55df9143

SHA1
5117c1f63308a63adb89143dddee046c21a7fb52

SHA256
410f86e1a5966cbc722c91d73cfe7b68899dd9ae892132891c3f03dd53ecf4ce

SHA512
ae18b4476ece884833b425c0c57967a0ad566eb4cfbf588651ede7112766a63477d0762addf07c5ce11a946cfd2e0da21a089b675f7f354440a53af846849449

Download Submit
C:\Users\Admin\AppData\Roaming\C2663\3B8C.266

Filesize
600B

MD5
38a533ea15eff1673c6ec44cf1512cea

SHA1
337107a364a0c5dcae03c1f53eb572800650be5d

SHA256
f134739e90b36b6b1f8a9488c849448f0cd67e7ba6c50eacd4a10bbf3bb20744

SHA512
cbbd4c15d675155b2ae4986a3bd0fc58cd22ad4035cd16b62fec5a8b9741152d2c64c55e34e580d8e10e9bce2971b1c68ee33d6e4a6744308f8ea9e93ae9b614

Download Submit
C:\Users\Admin\AppData\Roaming\C2663\3B8C.266

Filesize
1KB

MD5
e523a12bf6f397b26610529bdabd506e

SHA1
99bd1315b39c93e9587e9a2861d55558151d7cd8

SHA256
fd64c3d5df9826761723a51cd8ccd8b75b057759e23ad029cc9aad0c9d537a96

SHA512
e2b7bd01d9dc0c3e1fe2a6052cb58d574b9675e04129eb0b407bce2a277af36d6382ce7f629a1d57263d857be9171b9df3e2ec20282e10d59dba946f671d5291

Download Submit
C:\Users\Admin\AppData\Roaming\C2663\3B8C.266

Filesize
596B

MD5
aee381e69dd98cffb7a5dae8cb20acca

SHA1
132e929775c62d2414d6cfd7abc3266b0a4378e0

SHA256
9cf3de828e7306c11bb19a9caacb02986f81adf8c0659ae31330c8121499cbcd

SHA512
ab1e19e2cfcc62103dd8c0756c1dae705b693dd969e870b87d2bf4c2ba6bb854f524dd51e159922cf35ee7106cb436e0980e4e29ea9d055894e051d3716b41aa

Download Submit
memory/1320-133-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1320-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1320-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1320-303-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1320-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1320-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3164-13-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3164-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3164-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4276-132-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4276-130-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads