cycbot | 369fd9fc33268793e2425ed61ce664b2a03ac151334f9f9d3be7bed52cee635a

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe
Size 182KB
Sample260919-sl87vssdla
SHA256 369fd9fc33268793e2425ed61ce664b2a03ac151334f9f9d3be7bed52cee635a
MD5 9b44e4440ea4d48f1e742bb051cfd6ff
SHA1 22687ec4f536a131ef462d62516691dff76a4691
SHA512 33e549f313e647b4196082c4b92910858cfdf98c5738c0874d07642c513a5df9c5dd20fee9117c2859468a5a31b578b23a6868bdd54a4d0d566a6e5dacd2e6b9
SSDEEP 3072:w7zFOI2VwG2gdTpGrP3FaFpwdXk21Om6z6shyPUNlyftzj9SdsVRK8syZWR:wfEI6lddTpGbkwBpEmgLzP+j9SdeRlZc
TLSH
T1CB04F25C5603D41AE371B4F83003E339873E24D9928A1DDB7E95B33A6B2B7B1350666D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx

Malware Config

Extracted

Family

cycbot

http://worldmotoblo.com
http://resetmymemory.com
http://fastblogportal.com
http://freshmediaportal.com
http://yourimagearchive.com
http://myblogstoyou.com
http://stotre4image.com
http://allsoft4you.com
http://videocontainer.com
http://maxtroeurosys.com

Attributes

payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

http://crazyleafdesign.com/blog/images/share/stumble.png

http://crazyleafdesign.com/blog/images/share/facebook.png

http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

http://psfk.com/img/icons/twitter.png

http://psfk.com/img/icons/facebook.png

http://healthylifenow.com/templates/7348/images/header_logo.jpg

http://healthylifenow.com/templates/7349/images/header_logo.jpg

http://hollandandbarrett.com/images/footer/account.jpg

http://hollandandbarrett.com/images/footer/account.gif

http://nationsautoelectric.com/images/50-217-1_F_1_.jpg

http://nationsautoelectric.com/images/50-217-1_F_2_.jpg

http://onlinebizdirectory.com/images/PowerShowBanner.gif

http://onlinebizdirectory.com/images/PowerHideBanner.gif

http://lostpropaganda.net/blog/pics/3321.jpg

http://lostpropaganda.net/blog/pics/3322.jpg

http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

http://onlineinstitute.com/g7/images/logo.jpg

http://onlineinstitute.com/g7/images/logo2.jpg

http://onlineinstitute.com/g7/images/logo3.jpg

http://onlineinstitute.com/g7/images/logo4.jpg

http://onlinedatingsecretfriends.com/images/im133.jpg

http://onlinedatingsecretfriends.com/images/im134.jpg

Signatures

Family: Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4604-8-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/5032-71-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/5648-72-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/5648-154-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/5648-192-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4604-8-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/5032-71-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/5648-72-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/5648-154-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/5648-192-0x0000000000400000-0x0000000000490000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2708	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2708	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 4604	5648	jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe	89
PID 5648 wrote to memory of 5032	5648	jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:4604
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:5032

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\dwm.exe
1⤵
PID:5236

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7D1B.AF4

Path C:\Users\Admin\AppData\Roaming\7D1B.AF4
Size 1KB
SHA256 cd7a0b1881be061482b3da26d103c3a7aa5c665f8eb654d035305d63ffe091d5
MD5 705ec37a475d07b1f06aebf97e7aa1ac
SHA1 848cadb656affc5426cbc6e839a180c1acf1d9af
SHA512 f6d34353362a9410efba0aa5b3ee44fa8fc218f035173d86753febbff32d8e6690e23944f506f70f0eb2b586d2d02b688f9ad7dfe7a08110831379bc5c40df51
TLSH
T17431CD97BFDC16E0CE00447F211E451177C4D25933C2D38FA5C455604CC2DD94C256F4
MD5 SHA1 SHA512 TLSH

Submit Download

7D1B.AF4

Path C:\Users\Admin\AppData\Roaming\7D1B.AF4
Size 600B
SHA256 90b28b810d8df0ad16da382c253404e7e0b4992e6a6fc1baa6766c9721810ce8
MD5 f45e57b88d6b6613dc9639070450b9bb
SHA1 02c0e9dfc879a2e566839c860f9e7e4d64f1fa90
SHA512 deef48f5b2f756868ab2800fd86048bd9ceb88ed749aad06eb84a0fafedc1a04244dbcc4fb9f49db9d29b587f1a1d466784a6dacae06a6b1e84da642c161c9c2
TLSH
T16BF02200F0AC032BF0200C3E880B8000CEA8E800B38003C322C828822C002F2A8220B0
MD5 SHA1 SHA512 TLSH

Submit Download

7D1B.AF4

Path C:\Users\Admin\AppData\Roaming\7D1B.AF4
Size 996B
SHA256 bd83d808549687a84de2646f203cc41edeecb8280d7949919c4b9d6e61ea8534
MD5 fb106351d376125c6d9b4d7fb359bd2e
SHA1 feb8990b3f85603aa809ac1d3dbd2321bf1c1611
SHA512 3347dfa8bb6f4b3f53386f924fc66a9268ab798af77a3e760c1e633f5b8242609329d6d08473c0003090da061f597c2358056bba183df305c327330d980ac2e9
TLSH
T19D118047FFDC1761D900483F100B4511B7D4D2563381938B51C455505CC15D94C152F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4604-7-0x0000000000550000-0x0000000000650000-memory.dmp

Download

memory/4604-8-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5032-71-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5648-1-0x0000000000760000-0x0000000000860000-memory.dmp

Download

memory/5648-13-0x0000000000760000-0x0000000000860000-memory.dmp

Download

memory/5648-72-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5648-154-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5648-192-0x0000000000400000-0x0000000000490000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads