cycbot | 11b760b5d247727aeb2c6bb5596cf2127e9702fc800bcac6f211aa915849c2ac

General

Target

JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
Size

167KB
MD5

73a169e431975e2cee9ae449f16c4073
SHA1

6d26afcd2cc020b032a43f8d2d8f1d2afc32621a
SHA256

11b760b5d247727aeb2c6bb5596cf2127e9702fc800bcac6f211aa915849c2ac
SHA512

594809de401e2e5e2274d16a3055f2d67973578577a7f33f92958a4f4de52a5da5646846e6d25b1a80ac0bef6389dd1d35010ef5571cc64fc2a0f2b8397d8baa
SSDEEP

3072:QOXbTyNkYhsO1d3NTw8RgA/LqNExmHURwslnInWbUt+w/:vyNrhd1w8RDxmHURJlWWbU

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2428-10-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/1048-21-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/1048-84-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/1648-88-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot
behavioral1/memory/1048-192-0x0000000000400000-0x000000000048A000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1048-2-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2428-7-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2428-8-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2428-10-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1048-21-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1048-84-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1648-86-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1648-88-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1048-192-0x0000000000400000-0x000000000048A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2428	1048	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe	30
PID 1048 wrote to memory of 2428	1048	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe	30
PID 1048 wrote to memory of 2428	1048	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe	30
PID 1048 wrote to memory of 2428	1048	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe	30
PID 1048 wrote to memory of 1648	1048	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe	32
PID 1048 wrote to memory of 1648	1048	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe	32
PID 1048 wrote to memory of 1648	1048	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe	32
PID 1048 wrote to memory of 1648	1048	JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2428
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AC5B.977

Filesize
597B

MD5
1650f800fac8e45e595d6d514a57efb0

SHA1
d47ad7fbf604dc3a0477cc6400120c308a61917e

SHA256
6b1a426bec0f0aa12e5d919a298b5c807d55b87b3cd2d04b97e46157b22b65de

SHA512
322efa0493eee1a091d04fdb02675c982c14a3d408ded75c2f8757cd3f431315f72bc8e0111c9f16ed82f52e821ae7d480e73909960496b7e85e35b6d3a7caf5

Download Submit
C:\Users\Admin\AppData\Roaming\AC5B.977

Filesize
1KB

MD5
193c0fba14622ae8b12e8e3293039e26

SHA1
80070920e900a9ca456fcdc7e5d556b24fad2513

SHA256
deb5fc3548dacfa885694fddc1795805a03f333025041cfa7ea5eb439c8100dc

SHA512
8bff371b26acaac3f73519d6a2963b67f0a4986ac3bf94792250a05e2f0f4ed6385c49b492bb5c361c63e567ba89c0566b0b9ff78bf4f99c416896d44a1cf3ad

Download Submit
C:\Users\Admin\AppData\Roaming\AC5B.977

Filesize
897B

MD5
07e4b3e789952ec11c3809a4e0f582c8

SHA1
1089902ebd98b6865fcc11856586eb00922ec4ec

SHA256
223f6fc71d67790e0ff80f014977787b547946c5b5db683fef356731c95f3ead

SHA512
64ab4d4c82a29a118fa95b7328b55598bb39d63686fd6ef8fd1a709e6b25dd491aa80e339611f2e85c7a0210e440db5a40962028c83f85e0f5178281b8bc58aa

Download Submit
C:\Users\Admin\AppData\Roaming\AC5B.977

Filesize
1KB

MD5
d3ad283c78638a17de77e3b9637e1d48

SHA1
6bffbbca16f62796d9830efef1535ad6c3102557

SHA256
1fde371d30d5b1d30aa9cea976ad17a7f9bcc4894e588835328a7ac785feb19a

SHA512
a7c98def9d9570b2a333555face30712a81a2a2da9e186f57a5ac61e1c8b6df6b91efe77802af6819a0a19f1c78097e5e69848eb132871e10fe17e251e9e7c52

Download Submit
memory/1048-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1048-2-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1048-192-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1048-21-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1048-84-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1648-86-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1648-88-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2428-10-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2428-8-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2428-7-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads