cycbot | 0dc56661ddfa05a119205ae911f404755901d2241cbd59cece7d5521cd928bbe

General

Target

JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe
Size

159KB
MD5

544b665518a7f190cab4eea1eecf8f5f
SHA1

dd0d1add84a2418c3717ccc0cf4006f4b11107c7
SHA256

0dc56661ddfa05a119205ae911f404755901d2241cbd59cece7d5521cd928bbe
SHA512

a68633ea57f239802ef9d2824c3603adcc43ce1dea37144af8ff355ce34579e5d068e98ffeeeccc847d53c36ed2281483675fc8108a25f5798c0cb20f2e17859
SSDEEP

3072:2Lyeymq4e1DR44OH3x15jitcDiOD7bGXHKDngzP4ma20V4d:VeA4sDQ3x13rOHKLgzP4ma20C

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/576-9-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2500-20-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2144-89-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2500-90-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2500-200-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/576-9-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/576-7-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2500-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2500-20-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2144-87-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2144-89-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2500-90-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2500-200-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 576	2500	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe	30
PID 2500 wrote to memory of 576	2500	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe	30
PID 2500 wrote to memory of 576	2500	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe	30
PID 2500 wrote to memory of 576	2500	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe	30
PID 2500 wrote to memory of 2144	2500	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe	32
PID 2500 wrote to memory of 2144	2500	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe	32
PID 2500 wrote to memory of 2144	2500	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe	32
PID 2500 wrote to memory of 2144	2500	JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:576
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_544b665518a7f190cab4eea1eecf8f5f.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D0EE.24A

Filesize
297B

MD5
178366b6d5b755d5ca5306e75034409f

SHA1
c7264c69fd2ee81f173ea90063782d3c877297ae

SHA256
1dd7b02f0b6046780c78abe758cb9834e78cefc9f281a980d6e6138b11735d29

SHA512
ff49b5ca7efecce32a39e4a8d392710deb108dd2a09439707b796cf8cfd3de38d5cc782c5790fe3d7d5f228ed65f02343372278f84fb0f1c7941ba909ddec026

Download Submit
C:\Users\Admin\AppData\Roaming\D0EE.24A

Filesize
1KB

MD5
61d6d9c2affb2028a9df4dd8a5256ce5

SHA1
2f0576792822e8951567c11d0ee643439ca06c6e

SHA256
fd9ebb66fe6fa6eadae855346e575de71f47c25cb938227e21567d93f2bd9942

SHA512
137c2488c7047fb42e360ccf257791fde69a4f3dd4506a22bb334774c6cbfa9f45de56004c936a27e2e5124a247474d82a590380af78671051298993ed0b29e3

Download Submit
C:\Users\Admin\AppData\Roaming\D0EE.24A

Filesize
897B

MD5
0b916ced8a238eb1ca061c17bb8fe785

SHA1
1bd4d2094b68db59fcec33efbd874bf4c02ed661

SHA256
1968ae857eff8700182e7a3df6c3a38c86c227370016a4d62ffeb227110f3d45

SHA512
bed40e775ce6805bfd0f2d078c313875a9bf2e646d2aab805d14f9239a36d211b0237666355ebbd75bd5042dc6cbc6f6971c35e0f0a1d4778675e3075d00b0e8

Download Submit
C:\Users\Admin\AppData\Roaming\D0EE.24A

Filesize
1KB

MD5
a88a55c4fa907ee8bb5466d4f5fb65bd

SHA1
e2858e7a70505f36437d3fed79eada0ea45b08bb

SHA256
375a5e4296a678222650ada5b89f7375178a9d01335bf5259b3823d59213b06a

SHA512
e2481d2ab4d8e59a31540ee22e5e83a8c3332508970c1ce21ba764ef63a56c309b17ed359e433ce3568818b79f9478de123996ef87f083d0565b76d454b0d2f3

Download Submit
memory/576-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/576-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2144-89-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2144-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-90-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-200-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads