cycbot | f339277fb4e1f35040584eb20143a7bf3fdb1f685703d5b0ffe4d2372c047af4

General

Target

JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe
Size

206KB
MD5

6c45614f4b86ac9b6e6c2c177f090331
SHA1

bcd6c0dda5b70c0abde14f4a01139c7630ed7afb
SHA256

f339277fb4e1f35040584eb20143a7bf3fdb1f685703d5b0ffe4d2372c047af4
SHA512

e26e69a8490c48534121a4aa5caa29647ccf1ce893b5327268e2b27df8e760973271ceb83b30eb0131cea3872626450c5ebdc825d08861a4eb0fcf8acb532ae2
SSDEEP

3072:lNe1hc7vtDx/AvKTn5hZ5q35IDIQ8MBYh4EC/gDTvmHNbZLHwM+ET+vG3vTK:Xe1KFDxDTn5hZQ3sMv/mBRwMnBL

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2104-13-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2104-14-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2580-15-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1624-78-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2580-79-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/2580-178-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2580-2-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2104-12-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2104-13-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2104-14-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2580-15-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1624-77-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1624-78-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2580-79-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/2580-178-0x0000000000400000-0x000000000046D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2104	2580	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe	31
PID 2580 wrote to memory of 2104	2580	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe	31
PID 2580 wrote to memory of 2104	2580	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe	31
PID 2580 wrote to memory of 2104	2580	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe	31
PID 2580 wrote to memory of 1624	2580	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe	33
PID 2580 wrote to memory of 1624	2580	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe	33
PID 2580 wrote to memory of 1624	2580	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe	33
PID 2580 wrote to memory of 1624	2580	JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\52AC.D72

Filesize
1KB

MD5
afaefd66a6daadc66ff11defc506ffd0

SHA1
56c266af90657ca89014b06c06e97b1ceb68de03

SHA256
3f3500daf34ad5ac9ba5f6d301a854f812378317f18d755bd4f7b9725459daf6

SHA512
4a6debcf2151aab52cef5f0ac99d3e175266b369a0edc0b0c9ef740da5d6640095af464d77a99bb9605d50e66d1dd13054dfa13326094fce4cd25d6b5b5a6f55

Download Submit
C:\Users\Admin\AppData\Roaming\52AC.D72

Filesize
600B

MD5
4ee5ec436e695bdb4aedf0da3cce8a31

SHA1
a62e89c8b8aec199d29c3467a87cfb06f6b82bc4

SHA256
8993861f9cd96fe487aa7fc4e5022cdbedc5badd0fcec798cc1d7aa0a65d0339

SHA512
0a9b7d6a58ec4ca1171685962bf132936d58db9036f36da1a28de7370d5f34fb997724897377074e47b88dd4212b26ee1eb15c82232a0645974cbfcca2e41b72

Download Submit
C:\Users\Admin\AppData\Roaming\52AC.D72

Filesize
996B

MD5
3f0b7912cfb662966c73c1310c755729

SHA1
b69f1efd22012848e3c4e6061e08d16df505bbe0

SHA256
04001e121b2ee6c7712f37300e9a98bffbeaa793c7503cc6d800fdf9932ade3a

SHA512
527b10f16664ac0867c22b630cece246ac5a1db2e3a88cda1d13cf149192ae5a0ed06db14a492cd4523ceb3092c96e08ae06fbb95e9957b5e64a321cd7a3eee4

Download Submit
memory/1624-77-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1624-76-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1624-78-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2104-14-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2104-13-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2104-12-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2580-15-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2580-1-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2580-79-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2580-2-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2580-178-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads