cycbot | c5a2f31bf7a0c893ca70477d32fe6f0baed0f149d25b171b200c97bff4ecdc46

General

Target

JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe
Size

205KB
MD5

76348aa8356a4175ce86504d6be20db0
SHA1

5dd1b9d3136274c23e2da1b6e6fcd12db6fa87fb
SHA256

c5a2f31bf7a0c893ca70477d32fe6f0baed0f149d25b171b200c97bff4ecdc46
SHA512

39e40d51e370199a8806f15c31fa94b9bcdd4e029618213a9b1b8e2df5205a1add4608c935c939b1c5973e346ce1754d41c6d986db3d680a4dbc1e2b8bce3ce0
SSDEEP

6144:3tRUHjTyhzghp2VLHBDA6Zg44z0q1E+9Fqbf2:3vUmghpITBDA6Zgl0qOMqr

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2488-8-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2488-7-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2680-16-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2680-83-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/1584-86-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2680-148-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot
behavioral1/memory/2680-149-0x0000000000400000-0x000000000048D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2680-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2488-8-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2488-7-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2680-16-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2680-83-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1584-85-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1584-86-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2680-148-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/2680-149-0x0000000000400000-0x000000000048D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2488	2680	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe	30
PID 2680 wrote to memory of 2488	2680	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe	30
PID 2680 wrote to memory of 2488	2680	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe	30
PID 2680 wrote to memory of 2488	2680	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe	30
PID 2680 wrote to memory of 1584	2680	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe	32
PID 2680 wrote to memory of 1584	2680	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe	32
PID 2680 wrote to memory of 1584	2680	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe	32
PID 2680 wrote to memory of 1584	2680	JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76348aa8356a4175ce86504d6be20db0.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A2E1.F88

Filesize
300B

MD5
96c2bd891ecd49268ccd59e433a51bf9

SHA1
8caa46ac772f00046902a7ee3e1398a64696599c

SHA256
2072abe46b9fea1843fdb6dd92484b1492c5cbd73a0111b9ba223467b9143332

SHA512
f7c0cfbd120459157a80cb3ae7515e1b45d258fbb64497f8514f4852242c5cf4a51ac8aac1acf46eab625cb14bd49f85920eb7467e8df0f83be66e580569c68f

Download Submit
C:\Users\Admin\AppData\Roaming\A2E1.F88

Filesize
1KB

MD5
9f0b8c8f0353ded3d58fad690cdb1ef7

SHA1
9c7da2f447d7ca77c1c39c3e177d087dd5bffc2c

SHA256
4371e2f7f6a1fc375efe38ed58277a3c207c404e8bf516c327c60a6c9ee07526

SHA512
33f551559b1b0d805083c587803a3c9492a7fa5d27f078ef0dc6f79bdfd140f5cbe8d9a68340e4fd5c46e5a6d3f50d6d7141990826b3ca92e27b92516ef97d42

Download Submit
C:\Users\Admin\AppData\Roaming\A2E1.F88

Filesize
600B

MD5
1f45089ec375c6c5175e1d252f5ed246

SHA1
d9570613adb22105ec219497cbb1bd89256af3fd

SHA256
763b05803b9f7e7b518aedc039d4c7b3d94da2c00c655d171a6662d9dd037f71

SHA512
b74508d34afedc0188c8c1d7b69af4a73fb2e5afc0e189a760c8271d0c8f74333c844948a4b2f4b2abab1b96fc77fa222a8f1a258dc9fe3d836bd519961ea8e1

Download Submit
C:\Users\Admin\AppData\Roaming\A2E1.F88

Filesize
996B

MD5
e546ecf764a3352a706c3f9b3db55c42

SHA1
0ef0e7ada9545dc928d613dbe060447813b4df08

SHA256
d9cdea16b27bec0aa075c72dd1ecdf375c01c1941e9a63930cab1a9911f8333e

SHA512
36fb3de6f00d72f40c7c8b58bc2a2b355e0de75c5b55bec4f60b67c6f832330d50295a52796ceb86faa9d600ea9a92be6b4c6ef47a27b6927f4ed69416b423d8

Download Submit
memory/1584-85-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1584-86-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2488-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2488-8-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2488-7-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2680-16-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2680-83-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2680-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2680-148-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2680-149-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2680-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads