cycbot | eb09ec619fcd2b6cf3f241f7b9558ebdbfaeaa50c9cf09487c1b4bb7053cd7a0

General

Target

JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe
Size

197KB
MD5

526b835901b8b4f60b93fdde9ff3ab24
SHA1

8ef4c3b70b17c3b4365100c69a041e925c416352
SHA256

eb09ec619fcd2b6cf3f241f7b9558ebdbfaeaa50c9cf09487c1b4bb7053cd7a0
SHA512

87e4a30eec10af67d05c088aeaef42c874ac586d48a4ab719d919d0bdd638617d41acea22036afb20f6fe1cea5360b8bab4d8ccc2d6aa6a634092689056be788
SSDEEP

6144:NNfMDnq7e4/YmA5DT33jaQN5HnKvnFeDwOac8:rfM7q7LAhTHjzVnOwDwOn

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2860-7-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2764-15-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/1264-82-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2764-83-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2764-192-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2764-2-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2860-5-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2860-7-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2764-15-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/1264-82-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2764-83-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2764-192-0x0000000000400000-0x000000000048C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2860	2764	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe	30
PID 2764 wrote to memory of 2860	2764	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe	30
PID 2764 wrote to memory of 2860	2764	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe	30
PID 2764 wrote to memory of 2860	2764	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe	30
PID 2764 wrote to memory of 1264	2764	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe	32
PID 2764 wrote to memory of 1264	2764	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe	32
PID 2764 wrote to memory of 1264	2764	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe	32
PID 2764 wrote to memory of 1264	2764	JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_526b835901b8b4f60b93fdde9ff3ab24.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FE08.91A

Filesize
1KB

MD5
f18c64218c0aed061be48d4125b8e47c

SHA1
9e843b2dcd5c1ca690cd046774197802b40c2093

SHA256
517c31b562ab5ddc376a0351079572cbffb63ba378c7248cf03cc64c3e784e88

SHA512
72ae4f5e08825270cda9a34cf06cfdd411a5f99dfc75781d55b523d4e300f3f894d6f6e60f263682cf219efaada16a0654bb61ccab92abddc295800c6c8cff17

Download Submit
C:\Users\Admin\AppData\Roaming\FE08.91A

Filesize
600B

MD5
28fbdf012572f0c9e0516142a14aaff6

SHA1
291b5b75b51de591f2650e3994a5d131e0b1e02e

SHA256
92ec5cb19f01d516a57feb09922c8d4a6fec76eb867398193a02e835325bd475

SHA512
92d705a55c08c830b03d6f089da8ba9fb59f10e7ee3337fb45d57e558364b05c0c0fa42f3b9f750033ac126e60d2a14750b49711475a3dcb579c469fd890c4c8

Download Submit
C:\Users\Admin\AppData\Roaming\FE08.91A

Filesize
996B

MD5
2b6da73350339e84b18f3c255e21d00f

SHA1
62fa74b76c3e8ee603f11a080f4ba522fae8bbdb

SHA256
356ab10b86ef2f1ff519685ed9eb655757298dec70e1bb386a890b49514a47fc

SHA512
63815cc3fe6d4c4a5845e82d969bbd56e302cfd25cd087896df71d1e181655cb64bd05de4ca3bd26229843e747d589452286a19f021552a2f140b5cecdf86fe5

Download Submit
memory/1264-82-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-15-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-83-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-192-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2860-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2860-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads