cycbot | 1b06879a9c0fb6c96885cd6d78700673ec1be6e31d8ffe677b96f03846bc3f04

General

Target

JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe
Size

175KB
MD5

941795a65af07a349d3d9bd7bb8c77a2
SHA1

58aade3d1e8c5285b6a3413038a1dc039307aec8
SHA256

1b06879a9c0fb6c96885cd6d78700673ec1be6e31d8ffe677b96f03846bc3f04
SHA512

37719660b96caf819657146d8ff579d30bdb745db84e6a172f53704f0910198d9c61056cdec91b9f533978eb6a7b62cafe302f4013295510adad181ae8d1e6b4
SSDEEP

3072:Oe1gpuU2nZCuoW/ZIZMiQLZN6BCalsJGLTeKMcUTW:OeBJZCu1/KZMvLXCfsiTkcUTW

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1640-14-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2716-15-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1236-80-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2716-81-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2716-161-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2716-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1640-12-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1640-14-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2716-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1236-78-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1236-80-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2716-81-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2716-161-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1640	2716	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe	30
PID 2716 wrote to memory of 1640	2716	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe	30
PID 2716 wrote to memory of 1640	2716	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe	30
PID 2716 wrote to memory of 1640	2716	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe	30
PID 2716 wrote to memory of 1236	2716	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe	32
PID 2716 wrote to memory of 1236	2716	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe	32
PID 2716 wrote to memory of 1236	2716	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe	32
PID 2716 wrote to memory of 1236	2716	JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_941795a65af07a349d3d9bd7bb8c77a2.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\37F0.0F6

Filesize
1KB

MD5
1eac1c97535ede09a425f2bf12747c12

SHA1
543e746ee07276d45f8c0da1e2428ceb6faa27a8

SHA256
fb69e0faaa90f3fa2b3e1859cbd7aed4785aaf9d9f0c6a87d217d469aa602fbc

SHA512
7b2536fecaecadc52c977f520261faa60af4a23e9149ceb6f2bf81e3ca18686047a8150d720261a02bc1e17f2d46536e7245db4a78dde513c6b432e459d640b1

Download Submit
C:\Users\Admin\AppData\Roaming\37F0.0F6

Filesize
600B

MD5
7a32c2e320176eb904883cf9b2f33cc3

SHA1
c5f85d8a63b06dcb9e1f873023ffd8cbe780a0ba

SHA256
b5308b2eb0470bb9ec2c63b950943e7a03c01e02d56a7656b9255abe269d0628

SHA512
1b8e41e7d4b05a5f05541b16b0535469db79df1ec46729788d80975c74c6dad2eb0e58b522736d786ec4b236014595d5e8f787d567aed6bef583574b5cdede3d

Download Submit
C:\Users\Admin\AppData\Roaming\37F0.0F6

Filesize
996B

MD5
f2aa9277477b921e20be67fcb7dad6a6

SHA1
f9eaa106d32f8bc36fb405b18c3006a28e8f2c94

SHA256
ab986340b6c1b7ab97eba9b3c52220ba8f3a7c80958a7b622b877776ecbc4d64

SHA512
a1fdc372b417ecd5c53ca830264ff75c4059cee848b5844364035454f5838c0e5950725cdd395871a17d458ced566548f94da5a3dfa270538e1f8ef0a45e5c19

Download Submit
memory/1236-78-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1236-80-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1640-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1640-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2716-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2716-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2716-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2716-81-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2716-161-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads