cycbot | 2c86c3f27054047e5fc098e3405cd008fedf05e81d432275f45cdfd5410d9a53

General

Target

JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe
Size

164KB
MD5

57d323efdf2a4cff753490bb9da4f8e2
SHA1

3219f24b2cd0ce140d7c39b5a5bc27d6156fa801
SHA256

2c86c3f27054047e5fc098e3405cd008fedf05e81d432275f45cdfd5410d9a53
SHA512

b3aedfc357ddd22d972196e2e901f26d1dc12b74536460b7f04bfdc495ced248bb1f1a18819cb38d62f969fe945f17709c4dfb8b9506edf18e145e7239e96423
SSDEEP

3072:p5FU+P/FtK/d9bSXsnDPufBbNEQuLSnrUwvjJNmsilCaJ:pLU+P/FM/d9bSXsnDPuJbCJLgIujJNV

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2416-6-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1700-14-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1700-88-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/572-91-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1700-191-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1700-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2416-5-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2416-6-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1700-14-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1700-88-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/572-90-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/572-91-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1700-191-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2416	1700	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe	30
PID 1700 wrote to memory of 2416	1700	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe	30
PID 1700 wrote to memory of 2416	1700	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe	30
PID 1700 wrote to memory of 2416	1700	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe	30
PID 1700 wrote to memory of 572	1700	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe	32
PID 1700 wrote to memory of 572	1700	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe	32
PID 1700 wrote to memory of 572	1700	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe	32
PID 1700 wrote to memory of 572	1700	JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57d323efdf2a4cff753490bb9da4f8e2.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BD26.FF4

Filesize
600B

MD5
e2741e816ee689ae547025441bb628a5

SHA1
c85b9301df3539cac2cebdb10648d81ed2c0bc1c

SHA256
045a07df01f70c4fc816867c17d0b289ae50e4bb7fba6dac8d48888612e6f72f

SHA512
b752c13d0b09346c982f941358a5e7a69be5b2aba611d6deb63ea9c3193ba7f27ac3c3b0e8d4b92788d1a84f06353802e7657d0edfaf3b54f4efc485d1359977

Download Submit
C:\Users\Admin\AppData\Roaming\BD26.FF4

Filesize
1KB

MD5
b11f5c11a874708e8cc51e392eba6b1a

SHA1
359ff6048fdf32d63e88265a0be904d3a9f71f0d

SHA256
a1219234c09b04d3a89b37a6c1ed6d481aa26c093326f7d2ead5b5201af25128

SHA512
3c01cfedbec585c910162f6ed0b4f78eebb9433b1ec1ab8506cf33e6577068f38d645b64ff6ba805d1eae6dce942be03cf0fa420086ec188afa0e11bb92ac2e0

Download Submit
C:\Users\Admin\AppData\Roaming\BD26.FF4

Filesize
996B

MD5
8819ed7398d3933fb1c3e7d00de0be43

SHA1
699c4e66094f6bbd939f5607e4939f5b7d5e6071

SHA256
36992e2905592107d0ac397b4d1fd93056ed336ab917e1d48836bf46f9bc8303

SHA512
3200cf5527276c3e8a0eb2d598bd5d9ba240f6ebbd20e000e59dd5a0296734cffd4468076c030421c8fad9c9652c7ad82a7f5deb37d5c8b3b3bc2d24e356cc90

Download Submit
memory/572-90-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/572-91-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1700-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1700-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1700-14-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1700-88-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1700-191-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2416-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2416-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads