cycbot | fce33b5019bb0866ac8ed04dbf70cb062f1209ce2eddd51fdc307f5c46e869f2

General

Target

JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe
Size

160KB
MD5

42d3da1b2bc6c14e8a7c5c48be941bd5
SHA1

0a53d6b09099acb7b68b16f1e74b2f90f5b17038
SHA256

fce33b5019bb0866ac8ed04dbf70cb062f1209ce2eddd51fdc307f5c46e869f2
SHA512

fd145be876cf9373cc387bc52b1c1aaf87c5457b6d0fd913a63d67dd1ccab572cafd9f957fdfe30c7ba0f433891223475f739d7d9925fbb951f19bb60fcacd97
SSDEEP

3072:Ht4kwN08xnd9TN5m0wJUOWTCGaL6+U9N5SHnydqVcMDZ3t:Ht1w/d9Z51TOzv+l5inyN+9

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4860-17-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4332-18-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4332-19-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/2020-127-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4332-128-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4332-286-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\7171E\\AEBE9.exe"	JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4332-3-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4860-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4860-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4860-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4332-18-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4332-19-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/2020-125-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/2020-127-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4332-128-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4332-286-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4860	4332	JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe	84
PID 4332 wrote to memory of 4860	4332	JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe	84
PID 4332 wrote to memory of 4860	4332	JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe	84
PID 4332 wrote to memory of 2020	4332	JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe	99
PID 4332 wrote to memory of 2020	4332	JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe	99
PID 4332 wrote to memory of 2020	4332	JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe	99

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe startC:\Program Files (x86)\LP\E937\873.exe%C:\Program Files (x86)\LP\E937
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42d3da1b2bc6c14e8a7c5c48be941bd5.exe startC:\Program Files (x86)\1E307\lvvm.exe%C:\Program Files (x86)\1E307
  2⤵
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7171E\E307.171

Filesize
996B

MD5
bbc1689784969aad41c50acdd5af7f72

SHA1
a16968ace1bb067adad553365c091e0fffedc422

SHA256
da5775accbb31a3daba104e546d190cdfc45ec12d8059bfd6f22bdac6513a9d7

SHA512
659d749517a5b0fcf1edb361b5c24552d5fea691b6f2c23a15ea52eeed6221aa4423f9ac937a482ec96b7f15fa29f0f2a081263e5e893dac8badf709d84e5c85

Download Submit
C:\Users\Admin\AppData\Roaming\7171E\E307.171

Filesize
600B

MD5
277a754d7253bff9992452c82af7dd94

SHA1
2e888ab28ad2b6989e0c90cc995abe77cd966444

SHA256
2b932dca7b9677c922477d1d5a7419d8524a63ef3cfd75d8168ab5ae5af401c0

SHA512
567b5d1af1e2f26bfcd743838e73501f8146382e025b4329b1af4478e45a8d31e54e2bc49b21d98755a585ff3c1f9cba2a6e444dc85baf282f6a1a312ddf6c4d

Download Submit
C:\Users\Admin\AppData\Roaming\7171E\E307.171

Filesize
1KB

MD5
3660f026c29f0b8518519d3707334bdf

SHA1
fea7b658755487b34c830660e63d048b2a2be0a3

SHA256
fd998d8179ff3f9103cc4be41a631c6046a7d894f24c282cfc3b0ca24d2c30b7

SHA512
4764c709d2fff94982506c834a9fd598c80556e818ce94dd84105c403967c582974658c2f3f782b7993f0272ab1da859ca8753324c4a89245c1fe4529ddb0f91

Download Submit
memory/2020-127-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2020-125-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4332-18-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4332-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4332-19-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4332-128-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4332-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4332-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4332-286-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4860-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4860-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4860-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads