cycbot | 2f93e1cf807d14a2a72a38ce21f76e955aebf48ecbd2ff9d59be93dc2efeda81

General

Target

JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe
Size

179KB
MD5

2a388d76ab8383210bce6105147f7998
SHA1

67f698dad6c791b84fb7d0408ada18218b0b7298
SHA256

2f93e1cf807d14a2a72a38ce21f76e955aebf48ecbd2ff9d59be93dc2efeda81
SHA512

652c3093965ed16a84380e0179f4050902fa520e9b24a4a41cc0fe532d84a7ff085b272fbb069ff3ade8b7967ac6d1751274147c72f4e74ee31e0c30104152fa
SSDEEP

3072:Dz2KVg5yFIX4L+Q0rT1HaGHTtHTPSgELuA2iHmS8F8TEel:n2bYY4SrAGzlzSgE52amNFo

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2936-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2936-16-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2184-21-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1380-86-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2184-143-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2184-186-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2184-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2936-13-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2936-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2936-16-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2184-21-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1380-84-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1380-86-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2184-143-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2184-186-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2936	2184	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe	30
PID 2184 wrote to memory of 2936	2184	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe	30
PID 2184 wrote to memory of 2936	2184	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe	30
PID 2184 wrote to memory of 2936	2184	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe	30
PID 2184 wrote to memory of 1380	2184	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe	32
PID 2184 wrote to memory of 1380	2184	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe	32
PID 2184 wrote to memory of 1380	2184	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe	32
PID 2184 wrote to memory of 1380	2184	JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2936
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a388d76ab8383210bce6105147f7998.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F36D.A71

Filesize
597B

MD5
b8fc6739010b51a011fddce8c94cff66

SHA1
8b1d6a96990c6d07cdf84479bb20843d7f053333

SHA256
cb15deca6f440aca7b898dd947bdde81f69ef8cc34db57fb7a01dade64c0fe2c

SHA512
992d721ed348dd7cfc5935d0eacd9b9605a01eb25b277b339dfbc3e63854cf5657934b93725d710dc9c8b405cca517cf64a5e95502542bf24f4d09c1e63c59bd

Download Submit
C:\Users\Admin\AppData\Roaming\F36D.A71

Filesize
1KB

MD5
ff8ef78d23adfe58c7291db8971aaa85

SHA1
95f3f20436074571e44fa03ca3bb27ba51423778

SHA256
b877753f218204b9c8930492c785b1f6193d41e3ede6fb57132716f7686e3094

SHA512
0a65bc7fe65949d118012d4f1e0733c377bbdebd337c95c8a06c7d2f2921f6b306f399756e4cb71354498afafd2f8efe2b4d2bbf75a392d04388b79128579129

Download Submit
C:\Users\Admin\AppData\Roaming\F36D.A71

Filesize
897B

MD5
79da8a9a5dac35a3282297ba417fd42e

SHA1
118d6c72da5013bd26648d31c69355b5d91c8319

SHA256
27e41fdc9865036e65ae7993f55adf68bb65264d0a4c5de6dee7f35a422758b8

SHA512
b2bf3a08f9fc1a938421532a709c50622cf68cfd7054532632e0eb199b3ae669a0f9e9888af7d8e5242ab677660a0ce7a251907ac1581c3994d562c2774e511e

Download Submit
C:\Users\Admin\AppData\Roaming\F36D.A71

Filesize
1KB

MD5
eeb49312995530b912b70f5344a695b7

SHA1
058b31ab16a97e9f21f1b9cf019f93087e0ef5d7

SHA256
d098cbf8bddba36da0785ca9ce2371693308076f5109c460dcc42083b3db435f

SHA512
6450ea02266987395261cc1ba57db6ec0fa139bd979bb09217314477be80e6a7886ddcde4dca825fe12f4881e778bc625d316d4dc6081cb691e731414fdf5bf6

Download Submit
memory/1380-86-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1380-84-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2184-21-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2184-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2184-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2184-143-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2184-186-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2936-16-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2936-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2936-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads