cycbot | 7dd37c98986002c498e595d9cd711c474d306db23ccb7d4b14f1533c46c45267

General

Target

JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe
Size

181KB
MD5

614ed101705dc1c4085807214fbd4cda
SHA1

a1d3fd5d1eeea096a8289c822095faaf7075bc7a
SHA256

7dd37c98986002c498e595d9cd711c474d306db23ccb7d4b14f1533c46c45267
SHA512

83d94e6be7587a2607440393ba15aeb87a997d966bd0f40c7c498d8187acf0ded54e24202b8c932e21d3e7a1c65598c48fff7dd5a14052259c1c98d04131a813
SSDEEP

3072:PC+da4klDUVSp07wM2VH5k9ZCfe0CVvNqRCeuJ77PL82fWztxonseCi+OSgTSP:Pta42HHk9U84RfgU0Wztbli+OSnP

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2308-7-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2348-16-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/756-80-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2348-81-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot
behavioral1/memory/2348-176-0x0000000000400000-0x0000000000442000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2348-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2308-5-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2308-7-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2348-16-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/756-79-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/756-80-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2348-81-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2348-176-0x0000000000400000-0x0000000000442000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2308	2348	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe	31
PID 2348 wrote to memory of 2308	2348	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe	31
PID 2348 wrote to memory of 2308	2348	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe	31
PID 2348 wrote to memory of 2308	2348	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe	31
PID 2348 wrote to memory of 756	2348	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe	33
PID 2348 wrote to memory of 756	2348	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe	33
PID 2348 wrote to memory of 756	2348	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe	33
PID 2348 wrote to memory of 756	2348	JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_614ed101705dc1c4085807214fbd4cda.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\05B2.A2A

Filesize
1KB

MD5
fa3a6d8aef83c5581053d4810b82877a

SHA1
feae404e9a54e561c2434fb71f518ce006cea058

SHA256
97f18443590d3daefd1d66be730c4945b20740218283f5ae3abed04e60acaa19

SHA512
b345bd5accbe5ce2f701612e3706ffdc8209740c3f5b2eaf58c0a0fe20a86d8e214a6cc223516402297e9b31b38ecddd272af162f39f3f2137fd44c8719d6604

Download Submit
C:\Users\Admin\AppData\Roaming\05B2.A2A

Filesize
1KB

MD5
51c272917a359b434296e650009a9f38

SHA1
14ba214c00d2f21ca5df6690e04282bf8194703a

SHA256
2f90aab914ccab9a961f03621cde80ad2599682f239b8dadae0f6988062a98f4

SHA512
4f704644f88fcce9868cf2d725aa23a6090e6a84fc4c7271908b33749b2a350802fff3897450e4add9a5e848eadce55adf40848fd5e26cb031746fddda966cb3

Download Submit
C:\Users\Admin\AppData\Roaming\05B2.A2A

Filesize
600B

MD5
d91dc45b65205cfa11401780f97a78b1

SHA1
b7d645b5395f41e652db583dbeb5ac4f0ec99d87

SHA256
abeae8e856291509952d3ca8cd20ab992f4268d56a64bab484da32c0b51e388b

SHA512
5fbf45876f74d7e161dfade6f68382413eb7057c00fd4bfdfa70eed4f00b882d4eb86780010f0c00c05bbc95b377ebdc3ca535c18858e2dfd85641370cfe25fa

Download Submit
C:\Users\Admin\AppData\Roaming\05B2.A2A

Filesize
996B

MD5
e87f96e38eea7120446afe2c07383cf0

SHA1
252913c93bb8eb87f2c979ca92766b51657aa58d

SHA256
b0626a4978a6507e27650de6a00988c06e4e34edae4b519ce9f1441ccd82d822

SHA512
8264cdf365d71acb96cd2bf6a0adefc5599fed977adf5fb393d8a58e29ea79dbb0ed6e8d1741577398047d6f7e7d6108add481c0fd0c1b1a78e6e304aea91725

Download Submit
memory/756-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/756-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2308-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2308-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-81-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-176-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads