cycbot | b1d5250f9238e7a26eda172a27a5e8d783b2fbf992631a1c42be72a976ef5af3

General

Target

JaffaCakes118_48424d61bbe95463813d519028f55816.exe
Size

184KB
MD5

48424d61bbe95463813d519028f55816
SHA1

99b2cf21e7ad98dbee855347db5e88b04691e2f6
SHA256

b1d5250f9238e7a26eda172a27a5e8d783b2fbf992631a1c42be72a976ef5af3
SHA512

a64662c0617aae47358272a2b14a665ca16985f73253bb72efff7a10d40f0561061205b9786056a518f59d7d1252788c51c7746086f38d9242189a27ecb349d5
SSDEEP

3072:0f3ZM5kiCeDxS7txhF7BiOk+5cOWAuEJONr3lsT6O8vaUO/NwbX850pMIWqojEW:6pM5kuSJxhdBiOk+5cOvJOR46O8v5Zit

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3620-15-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1772-16-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1772-84-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1720-86-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral2/memory/1772-203-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_48424d61bbe95463813d519028f55816.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1772-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/3620-12-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/3620-13-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/3620-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1772-16-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1772-84-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1720-86-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1772-203-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_48424d61bbe95463813d519028f55816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_48424d61bbe95463813d519028f55816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_48424d61bbe95463813d519028f55816.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3620	1772	JaffaCakes118_48424d61bbe95463813d519028f55816.exe	83
PID 1772 wrote to memory of 3620	1772	JaffaCakes118_48424d61bbe95463813d519028f55816.exe	83
PID 1772 wrote to memory of 3620	1772	JaffaCakes118_48424d61bbe95463813d519028f55816.exe	83
PID 1772 wrote to memory of 1720	1772	JaffaCakes118_48424d61bbe95463813d519028f55816.exe	85
PID 1772 wrote to memory of 1720	1772	JaffaCakes118_48424d61bbe95463813d519028f55816.exe	85
PID 1772 wrote to memory of 1720	1772	JaffaCakes118_48424d61bbe95463813d519028f55816.exe	85

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_48424d61bbe95463813d519028f55816.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_48424d61bbe95463813d519028f55816.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_48424d61bbe95463813d519028f55816.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_48424d61bbe95463813d519028f55816.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3620
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_48424d61bbe95463813d519028f55816.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_48424d61bbe95463813d519028f55816.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BE84.BC1

Filesize
1KB

MD5
fea7b8bb101a1f9455e5ed56623bc8f5

SHA1
b2c1c3797e3ee6df2f0bdf2e5f4778672fa2a6b6

SHA256
426edc2b64c3d114ec6e9d7a532f26e8715f08cc0106926ae3b1925bda859650

SHA512
69f58bc15328404a0f4347e70b270449e43d4e4650c896bd32c7cfeb04498f4384365a9df9a07672e2de5369b3850fe563de96d59b06d3e654a952a83383f3ba

Download Submit
C:\Users\Admin\AppData\Roaming\BE84.BC1

Filesize
600B

MD5
5f9e86256df90a82642bada31cdf06c3

SHA1
89bc9d27434a41c0fec53f74f3218b9c85a0af61

SHA256
5113b4fe1657dadf082874555c25c0dd199772b1e5a6b51ee3cab1dbb2ad130d

SHA512
312d88ff81578c44cd57a80ff4c8ab58bca4f81c59bbbde18527f710ea71e698a9217c73e6e16a53e2ceed070d6b9a12de5c4faf5cd9fe9e636d72bf4868615a

Download Submit
C:\Users\Admin\AppData\Roaming\BE84.BC1

Filesize
996B

MD5
2b719a87bd277e3fe8f92f7a653b4767

SHA1
026866703a755dbfc0ae9422c7a0a6248efa3ee1

SHA256
16c1d943d116172bb69f8088d96aa99596afff318415220ab6297c087a1ca495

SHA512
2e3daf34fff30e8952bc46df41e9b214692128117805f19cbd1fe4655800d1d1c6d06f24aead7415c540367936f44bd95871bd7804af3e69fa5b5388d45ddef7

Download Submit
memory/1720-86-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1772-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1772-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1772-16-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1772-84-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1772-203-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3620-12-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3620-13-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3620-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads