cycbot | e2e7bce386f2757a9dfec329a94869469866c9ad8e198dcee6ce12412ba8e6a7

General

Target

JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe
Size

182KB
MD5

6b02f81c2c1681708d13a8dd362cc809
SHA1

68e1a4cdcddb5b8d1bda38ac5829cc59aa7dc52f
SHA256

e2e7bce386f2757a9dfec329a94869469866c9ad8e198dcee6ce12412ba8e6a7
SHA512

39965f59e5d9bdeb723b7772d0074fbfe11d05b3469667864bc42dc65ddcf77216313ddde1c95dd7bb7ce6f2d12d1a0646092ac8cf972f91c9543382726a9be6
SSDEEP

3072:3gjcHBfqaePyO1vEwgIsoRziN9KEDCARg5bq6K/qqgS2f:3k6VNePyTwvTON9KEG5cqqgSO

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2772-11-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2280-17-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2668-81-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2280-82-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2280-175-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot
behavioral1/memory/2280-216-0x0000000000400000-0x0000000000466000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2280-2-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2772-11-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2280-17-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2668-80-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2668-81-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2280-82-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2280-175-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2280-216-0x0000000000400000-0x0000000000466000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2772	2280	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe	29
PID 2280 wrote to memory of 2772	2280	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe	29
PID 2280 wrote to memory of 2772	2280	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe	29
PID 2280 wrote to memory of 2772	2280	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe	29
PID 2280 wrote to memory of 2668	2280	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe	31
PID 2280 wrote to memory of 2668	2280	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe	31
PID 2280 wrote to memory of 2668	2280	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe	31
PID 2280 wrote to memory of 2668	2280	JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b02f81c2c1681708d13a8dd362cc809.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2DA0.E7A

Filesize
1KB

MD5
c6b4c34f2803beaa083af31e8a693a46

SHA1
e5d2e797d669d639e32253b783e5d68909053a9c

SHA256
9027d332fc8cb1fda72fd79314ae154ce870b7ebfd6b5d4565204e4ce07c8fdc

SHA512
321e49a4e048192a3e44ae7e7c2cc1dc3833a9a1aece6cf7c873e0435f10fae91fe0b6ebd0ba9d70a0295d40f20535bcbb8f683756dae71b40a0a2a9d6a7d80c

Download Submit
C:\Users\Admin\AppData\Roaming\2DA0.E7A

Filesize
897B

MD5
9b98a3b1c39078f6375d432c9b2d764b

SHA1
d6f59f2c26612d62353fa7debe877c887ef49947

SHA256
c40043d20a56eb54e2a71a92cf4a42ca5bb9d939298109f3f9f19ebcdf5717a9

SHA512
f1457af449a955c6b0e6329ea744a55f1504665c0a80828abad673115b11e1d85f10ad593923fbcae842bf1f33e6eb9444d375fc650d6694ebfe901313606663

Download Submit
C:\Users\Admin\AppData\Roaming\2DA0.E7A

Filesize
1KB

MD5
21d621db27ddc34d1ac43df8be28bf01

SHA1
cfec2356ce1d31d4cdff8b92996562205d3cd4ff

SHA256
2b3f30a07cc67366c3adf70fc6ac8b48b0fb9d24b126d0cc9b72a11dc1889583

SHA512
238bac04abc10587e9f62d1a234156fc524b0ec3a60970b4e51021b59f0698dae6e4a42ac4b32f56942d6a2dbb8373ad8cf466fe0cfcbc15a92b9f871b178af8

Download Submit
memory/2280-17-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2280-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2280-82-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2280-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2280-175-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2280-216-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2668-80-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2668-79-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2668-81-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2772-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads