cycbot | 60227bac02c0154bf1d0bc6d37d2b2a3459c169d6ae4b14446287d5a08cdd5c1

General

Target

JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe
Size

165KB
MD5

3cffc6cb43e8127d3ece522d5b110948
SHA1

bbdea1a19fccdee2164eb043ffccce64ec02d9d8
SHA256

60227bac02c0154bf1d0bc6d37d2b2a3459c169d6ae4b14446287d5a08cdd5c1
SHA512

863fd7592c83210e8df62004830cb83aa3dd99a50f63ab06d489f2512b65865b80dbbb426785362e9beed74e280d923ee2c605850691e9f504e76c320504b205
SSDEEP

3072:4c4t8ZZNIjdZdrkwu332MmFnRBpFa4djan8iF3740LXEhUQKa2Io0MsxF3b:45SlIdbDu33eFRBpFa4pwfU0l0M23b

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1760-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2284-18-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2284-17-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2600-132-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2284-134-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2284-292-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\84E15\\E4023.exe"	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2284-3-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1760-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1760-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2284-18-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2284-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2600-133-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2600-132-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2284-134-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2284-292-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1760	2284	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe	31
PID 2284 wrote to memory of 1760	2284	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe	31
PID 2284 wrote to memory of 1760	2284	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe	31
PID 2284 wrote to memory of 1760	2284	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe	31
PID 2284 wrote to memory of 2600	2284	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe	33
PID 2284 wrote to memory of 2600	2284	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe	33
PID 2284 wrote to memory of 2600	2284	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe	33
PID 2284 wrote to memory of 2600	2284	JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe startC:\Program Files (x86)\LP\2318\933.exe%C:\Program Files (x86)\LP\2318
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cffc6cb43e8127d3ece522d5b110948.exe startC:\Program Files (x86)\156E2\lvvm.exe%C:\Program Files (x86)\156E2
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\84E15\56E2.4E1

Filesize
996B

MD5
a6c28b59a3244b8660cb28ffbabc510d

SHA1
5390ec59de990b08365c2117c02ab1a93e50f053

SHA256
5598615b3fa5d46518d228bcd4ebabf086dad7fceacea08d923e490a1976447a

SHA512
0865113e780e310337f9df525b54b2297d6154a032d9f19f7718493d87026f708c6149266297c502254ce8dcc31e1b914899a9ba995f7a75198124d0ba6414cb

Download Submit
C:\Users\Admin\AppData\Roaming\84E15\56E2.4E1

Filesize
600B

MD5
be8d5acb9259f1bf7858339108a88ede

SHA1
c7b8c4f5f3fe39803b74c8917dd89ac3c1978af3

SHA256
3aa76be13f029320460070b4f31b17f74948ef35e3b87348a5c2545e21899d4e

SHA512
a12f68f819bfbbd9a8c94f058a9c64be31b4b961fb6c47c847fa0088ee8d946fcda0520c9388569a74013ca2ec438f20612dddb18a08f51ee8973de656b0b0f9

Download Submit
C:\Users\Admin\AppData\Roaming\84E15\56E2.4E1

Filesize
1KB

MD5
1cdb6b8d2fdc800d40dd949c464694f8

SHA1
8eeda14264fbfe4f2d11498e63d39820d5fd0b2b

SHA256
6281b2c6961c4de269dbfcd2471149a2ebd5dd5fb934f454018ddd473065038e

SHA512
d332e2942214e24bc2e6f0888efc42d594e39958179ed27785a8689feb17c85f7e2d824e873e97e278c36701a06151c9f12acd3aa63bd334f9009f9111d3816a

Download Submit
memory/1760-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1760-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2284-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2284-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2284-18-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2284-134-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2284-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2284-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2284-292-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2600-133-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2600-132-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads