cycbot | fb2564fbb02c8a5253a33a7af624c1c1c5fc896e34188f1c64c0f4ef99dcda81

General

Target

JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe
Size

204KB
MD5

96ec1f741a8f6aef5501048c1f6cbf81
SHA1

05162ccca467d38f1fba3196385d12ae0de9aeb5
SHA256

fb2564fbb02c8a5253a33a7af624c1c1c5fc896e34188f1c64c0f4ef99dcda81
SHA512

c481a90c3425ee8ee01112c02fc534c50186db0aa165a122b77d60921b2f7510cd26d0c3f5f08562d55d9df8e66289460b147b1aad11e7d891a7bbf35c306d9b
SSDEEP

6144:QQ4qCMLgpZ5Ip7AKCSkvEXtMSpGf8h68LcDI:n57nCbvE+Sgc6BD

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1916-7-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1156-15-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1556-89-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1556-88-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1156-90-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot
behavioral1/memory/1156-193-0x0000000000400000-0x000000000046D000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process
PID 1156 set thread context of 0	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe
PID 1916 set thread context of 0	1916	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe
PID 1556 set thread context of 0	1556	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1156-2-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1916-5-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1916-7-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1156-15-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1556-89-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1556-88-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1156-90-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1156-193-0x0000000000400000-0x000000000046D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1916	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe	30
PID 1156 wrote to memory of 1916	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe	30
PID 1156 wrote to memory of 1916	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe	30
PID 1156 wrote to memory of 1916	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe	30
PID 1156 wrote to memory of 1556	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe	33
PID 1156 wrote to memory of 1556	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe	33
PID 1156 wrote to memory of 1556	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe	33
PID 1156 wrote to memory of 1556	1156	JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96ec1f741a8f6aef5501048c1f6cbf81.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\40A5.9A2

Filesize
1KB

MD5
c29671afd383c8d92194ab22c1872025

SHA1
2b8c405d4d3040ff6ecc9e2165ba07cbaebc0c06

SHA256
afbcbfc2e2a1474c2d84a2bc588bd4fb12ab9aabc0cca831e17c20201d3e48a4

SHA512
4200413f950f3fda5c2d3fdecde4e0f0a8d23f8edf4f56afd958acfd9b551def498b54ba2ab72e4a7a1a8e73f2597ebbbbb1a460707c14b7fdd8ba618901af0b

Download Submit
C:\Users\Admin\AppData\Roaming\40A5.9A2

Filesize
600B

MD5
4129845386564681fda4b324294cea57

SHA1
c40546d7dc16a37a4dbe4e7db6b4c808bd70bd97

SHA256
e7babbecd4f1dea73a823fd904dc9a549f856fda3c59a447e5890157ed4e4106

SHA512
b3cb07e0c2b7c38b67d42c519d302369804585dbae737d8b4a2fe4d9953f128b1c2f789154acd38683e2ff6b65d4bc9ef825182149e5fce8149ae1e06f1f6e9e

Download Submit
memory/1156-1-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1156-2-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1156-15-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1156-90-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1156-193-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1556-89-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1556-88-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1916-5-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1916-7-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads