cycbot | 58402f0af858873033f1edfcfc1e7ad727ef9b6f8ad3e8903508c410be5a77ba

General

Target

JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe
Size

160KB
MD5

6ee89bf51d49c0f521aac20517ce6821
SHA1

c26cca3f537478437b824278c95e1174aadb8e8e
SHA256

58402f0af858873033f1edfcfc1e7ad727ef9b6f8ad3e8903508c410be5a77ba
SHA512

1a557b70b1ed99527e696cb7967ef999c0d0366d00793c91e92f76e0a91f42ff702820c72da39327160af72ff642dbd59981848ee05b69e9d9ff21479660733d
SSDEEP

3072:2bzOJ9VacUKG42tEplNc4rLqpssNX5SkG/zrfTG9WqvUEJmUwMKM2:2saR4EAnc4rLq6c5ZG/3fovvJmUYM2

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1632-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1056-17-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1056-18-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2060-115-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1056-116-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/1056-290-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\85C54\\1A84E.exe"	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1056-4-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1632-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1632-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1056-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1056-18-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2060-113-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2060-115-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1056-116-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1056-290-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1632	1056	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe	29
PID 1056 wrote to memory of 1632	1056	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe	29
PID 1056 wrote to memory of 1632	1056	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe	29
PID 1056 wrote to memory of 1632	1056	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe	29
PID 1056 wrote to memory of 2060	1056	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe	31
PID 1056 wrote to memory of 2060	1056	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe	31
PID 1056 wrote to memory of 2060	1056	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe	31
PID 1056 wrote to memory of 2060	1056	JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe startC:\Program Files (x86)\LP\4E68\5DC.exe%C:\Program Files (x86)\LP\4E68
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ee89bf51d49c0f521aac20517ce6821.exe startC:\Program Files (x86)\54770\lvvm.exe%C:\Program Files (x86)\54770
  2⤵
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\85C54\4770.5C5

Filesize
996B

MD5
e85d350b81db3632cb3edb7c6dc6c438

SHA1
4dbc9dedec8cc8d84490cf05894eb623b8215be8

SHA256
4c4e7d820e6d60e697c7797f11480a73155c3b2806648505773c8d0082553e30

SHA512
6b8194a06912b9327cc874e326bf0015c6f0ad143a464bea96525617f4715d889e41ace51726b1bad6625434b5b746933877fff835fc9ec30cb995a37c0a053f

Download Submit
C:\Users\Admin\AppData\Roaming\85C54\4770.5C5

Filesize
600B

MD5
a0f7e22dbf38d22c707e6abbe18b58d3

SHA1
72323200c39c41db958d3a88cafb1ee8e9eab550

SHA256
60c06db6b74427aa064aba6558d15a97686dcbf90bc7ec0a2c468b30c4cffb6b

SHA512
71795edb0031fb1f701d5ff931d729a5765489df1c6b5a68ec6f9968418574443081dc3d58592fe9dc2c1b3b7c92fb3323b9945cb099b54141606d7dee78577d

Download Submit
C:\Users\Admin\AppData\Roaming\85C54\4770.5C5

Filesize
1KB

MD5
3d05a89b99aab9abd3e4c7dd78e39d7d

SHA1
73f4d7e162af61b174b4f2b8a8867d71ab3d1f14

SHA256
ada31811becea813197d8c20dee53922413842561e22e1d2552d98b8fe732a0b

SHA512
c19b7aa4d47a6cc154ccb92c52ceb623e511c70160dee8b3ae097f1b6efa80d8af9672f6b674ebac2f047f9963bc95409d6aea4c9a977579a52ec6c604ae63af

Download Submit
memory/1056-116-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1056-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1056-4-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1056-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1056-290-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1056-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1056-18-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1632-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1632-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2060-115-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2060-112-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2060-113-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads