cycbot | 0c09ba37119df1297b51e28d9ff75c41646017d7f0c770890528662bda14bb5a

General

Target

JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe
Size

176KB
MD5

3d17a1db3d763035bc53ae1608e5fe31
SHA1

85ece5cb2d18fcd4fec2ef8c38fa2e427cbd4915
SHA256

0c09ba37119df1297b51e28d9ff75c41646017d7f0c770890528662bda14bb5a
SHA512

bf697e87142b58ca59c87032f8b122e4c38cc8117cc23d511ee03d1754cd226c17e81d47c39e43729e73cf6d820c3282ff6cac01737b538a4fd1dc5a18fca5e5
SSDEEP

3072:B9hYq6dQLFHft2/EOHSkfOjWD9AfZ2hj6+QNxuAPfHb:B9hYqUQpHF2/pykoWZPA3

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2388-15-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2388-14-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2116-16-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2116-81-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/1792-86-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/1792-85-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2116-193-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2116-2-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2388-12-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2388-15-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2388-14-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2116-16-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2116-81-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/1792-86-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/1792-85-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2116-193-0x0000000000400000-0x000000000048E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2388	2116	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe	30
PID 2116 wrote to memory of 2388	2116	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe	30
PID 2116 wrote to memory of 2388	2116	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe	30
PID 2116 wrote to memory of 2388	2116	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe	30
PID 2116 wrote to memory of 1792	2116	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe	32
PID 2116 wrote to memory of 1792	2116	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe	32
PID 2116 wrote to memory of 1792	2116	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe	32
PID 2116 wrote to memory of 1792	2116	JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d17a1db3d763035bc53ae1608e5fe31.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7850.ACF

Filesize
1KB

MD5
df8aa0323d79c13abee64444f8be3c79

SHA1
ce4ee525471b6e09ebc68886cdf7449789b964d8

SHA256
70f3724599186f718b67a7a0f2e5abd036efaa6cf7251f0b973e115b4ae4e479

SHA512
b4da3c533ec62817fc23be99740f353ea96ba06b9b9ee1f522883434987b14c5cd8d32a9dc108f2aaadd243c5a8f6de0795917b5a74792e51ebba0ec6e3494ce

Download Submit
C:\Users\Admin\AppData\Roaming\7850.ACF

Filesize
600B

MD5
18c584ee98245ed6317034178719e496

SHA1
3cf7f468da28e6c8fb6778216da9a307afc01ee8

SHA256
118786bc62a9d5a50fd5e651e29ddedb1087236ab614e277d1d09ffa5887629d

SHA512
93dd6368771d325a0b9df4250b7f364290c6a6fdcc2cb97b472383c7ddbc1bd61a8a0d4be7969d246ceb57fc55c20efacbd7be498ac900d948645f7ade9331c6

Download Submit
C:\Users\Admin\AppData\Roaming\7850.ACF

Filesize
996B

MD5
f13a17d68b31bdcf60a2e17357292902

SHA1
1cc29c39d0e9fedee56237e88400e1e75254e388

SHA256
285d22afdeaa5fe5d6a7624013e4143d645b62d93a3a3a10a0add3ae3da69480

SHA512
3fd45434be5ebf9edfb8e8afc393158cbad6846060695d7f0fee87c5b224724e588465b69676e3d669e0e230edd4cb8fa56bdf8bcc814fb810f29362afdfea7f

Download Submit
memory/1792-86-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1792-83-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1792-85-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1792-82-0x00000000008D0000-0x00000000009D0000-memory.dmp

Filesize
1024KB

Download
memory/2116-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2116-81-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2116-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2116-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2116-193-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2388-14-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2388-15-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2388-12-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads