cycbot | 6e2e612f9370c783e1530a334c3ed7a4fa3c3aeb51c06a0354ad82cf95e3c616

General

Target

JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe
Size

172KB
MD5

52cab382c53b6b75d9e279760db6e04d
SHA1

27c39ae79affa010bcd231ea403f66d6a8714658
SHA256

6e2e612f9370c783e1530a334c3ed7a4fa3c3aeb51c06a0354ad82cf95e3c616
SHA512

e30275c790c4aafebc427163d496f12f07be38e692e8da6b1a2494126dea8a4cfb4a4550323cbc103670daed2c31479fb8eb49e8e29be6d5392f6f5dfda559e2
SSDEEP

3072:GTDe1ALKu5G16xm7NI+inhd3x480mXjodBVCPbmVdP+Agiid1Rg9zJIHJDrWVtw6:MDe141xaohRx48sYPb2dGsqkzKHJkw6

Score

10^/10

cycbot backdoor discovery persistence rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4324-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1568-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1568-17-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral2/memory/4524-135-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1568-136-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1568-310-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\B7563\\F628C.exe"	JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1568-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4324-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4324-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1568-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1568-17-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4524-134-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4524-135-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1568-136-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1568-310-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4324	1568	JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe	86
PID 1568 wrote to memory of 4324	1568	JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe	86
PID 1568 wrote to memory of 4324	1568	JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe	86
PID 1568 wrote to memory of 4524	1568	JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe	87
PID 1568 wrote to memory of 4524	1568	JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe	87
PID 1568 wrote to memory of 4524	1568	JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe startC:\Program Files (x86)\LP\8CCB\C58.exe%C:\Program Files (x86)\LP\8CCB
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52cab382c53b6b75d9e279760db6e04d.exe startC:\Program Files (x86)\6313F\lvvm.exe%C:\Program Files (x86)\6313F
  2⤵
  PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B7563\313F.756

Filesize
996B

MD5
33cafcc96b7a242b3a69e58f9cfdc66d

SHA1
84eaa8c926085ec615bfbb9379aea894a2c3cf0d

SHA256
8969a49257208e1c82d4dbb16ce5add7d752d3ff9da9f3f0e2f85c623b0c3a03

SHA512
967629c163acffdd1aea54e082ab8b693fdd60541caa1781d59cbf442a67ef3fe06c85f0d314e6fe049b0692b3bab481289dff49ad25714e90bb359df3ce3d6d

Download Submit
C:\Users\Admin\AppData\Roaming\B7563\313F.756

Filesize
1KB

MD5
f6f7b14caba4bb53cc137e141d00727f

SHA1
217f84d4c6ad8f14c7acbd6fde261f049bcd0eb1

SHA256
5cfeb5f5f8da157a6f429ab2910adf41f2426fbbec40176875eddcc1521d3d4a

SHA512
f0455292fa858f0759784ac0f25586b18e0ec08ea5f62ba060793e94609a450d9c8954e1b5f1314e8300db30ae8afe9e69996ec637675f55b266be5f34f48b25

Download Submit
C:\Users\Admin\AppData\Roaming\B7563\313F.756

Filesize
600B

MD5
0abf879a9f2afaf5e250a4547f2c52f3

SHA1
f8688ef8d95f46a64421f866592241fe1408cbb1

SHA256
0288364ac7b42816e5d61e3efa1a9834c1ebd34cc0e5fd0e54555e25f3dc036f

SHA512
c33b4723d8b8d6fb0aa77dcddef09af34d3aadeb6371e731ece96cf51210bcd3f49f8b6622d01cb99da6626d869404c277b032c12efd17cb629550fd99d14828

Download Submit
memory/1568-136-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1568-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1568-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1568-310-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1568-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1568-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4324-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4324-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4324-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4524-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4524-134-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads