Resubmissions
23-10-2021 13:49
211023-q4pj3acda6 927-09-2021 16:25
210927-tw86aahecn 1027-09-2021 16:15
210927-tp7c4shebk 1025-09-2021 21:37
210925-1glj1adhh7 924-09-2021 00:57
210924-bbd6asfdgj 1024-09-2021 00:56
210924-bad4xafdfr 9Analysis
-
max time kernel
591s -
max time network
381s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-09-2021 00:43
Static task
static1
Behavioral task
behavioral1
Sample
APP.exe
Resource
win10v20210408
General
-
Target
APP.exe
-
Size
5.2MB
-
MD5
a0b4d2c96937104bcffd21ce69885a59
-
SHA1
6cda6e2bee6d67a5f407e4d7e96af9d76bfa7c79
-
SHA256
72cb50e5791e1fcb11d24bc4cff3b44379a529c5549fbf6f500adcd67bfe9139
-
SHA512
17b1b4de1bddb7f357744ace07509481e80eb8a63fa9c39ee00ecd7eba3b03611eb0e2329e88e20b05e8a2655fa67a7b699c8455c1fa9aebeba4384151ae2ee0
Malware Config
Extracted
C:\Windows\HOW_TO_RECOVER_FILES.Colossus.txt
colossussupport@protonmail.com
http://colossus.support/LPc6EwBqmyC8Tv9Glawleycars/
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
APP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe -
Processes:
resource yara_rule behavioral1/memory/808-114-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/1168-168-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/2184-172-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/2188-175-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/2708-178-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/1836-181-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/3616-184-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/3348-187-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/3168-190-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/1900-193-0x0000000000890000-0x000000000156B000-memory.dmp themida behavioral1/memory/1656-229-0x0000000000890000-0x000000000156B000-memory.dmp themida -
Processes:
APP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exeAPP.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe -
Drops file in Windows directory 1 IoCs
Processes:
APP.exedescription ioc process File created C:\Windows\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3912 powershell.exe 3912 powershell.exe 3912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3912 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
powershell.exedescription pid process target process PID 3912 wrote to memory of 1168 3912 powershell.exe APP.exe PID 3912 wrote to memory of 1168 3912 powershell.exe APP.exe PID 3912 wrote to memory of 2184 3912 powershell.exe APP.exe PID 3912 wrote to memory of 2184 3912 powershell.exe APP.exe PID 3912 wrote to memory of 2188 3912 powershell.exe APP.exe PID 3912 wrote to memory of 2188 3912 powershell.exe APP.exe PID 3912 wrote to memory of 2708 3912 powershell.exe APP.exe PID 3912 wrote to memory of 2708 3912 powershell.exe APP.exe PID 3912 wrote to memory of 1836 3912 powershell.exe APP.exe PID 3912 wrote to memory of 1836 3912 powershell.exe APP.exe PID 3912 wrote to memory of 3616 3912 powershell.exe APP.exe PID 3912 wrote to memory of 3616 3912 powershell.exe APP.exe PID 3912 wrote to memory of 3348 3912 powershell.exe APP.exe PID 3912 wrote to memory of 3348 3912 powershell.exe APP.exe PID 3912 wrote to memory of 3168 3912 powershell.exe APP.exe PID 3912 wrote to memory of 3168 3912 powershell.exe APP.exe PID 3912 wrote to memory of 1900 3912 powershell.exe APP.exe PID 3912 wrote to memory of 1900 3912 powershell.exe APP.exe PID 3912 wrote to memory of 1656 3912 powershell.exe APP.exe PID 3912 wrote to memory of 1656 3912 powershell.exe APP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c82⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 GFBFPSXA2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 GFBFPSXA -Verbose2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" -ArgumentList 6e42f05c8e4d24c3fa0ce2f2a8d203c8 GFBFPSXA2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 GFBFPSXA2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 C:\Windows2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 C2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 .\wmsetup.log2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 C:\Users\Admin\Desktop\*2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c82⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/808-115-0x0000000000891000-0x0000000000977000-memory.dmpFilesize
920KB
-
memory/808-114-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/1168-167-0x0000000000000000-mapping.dmp
-
memory/1168-168-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/1656-229-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/1656-228-0x0000000000000000-mapping.dmp
-
memory/1836-181-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/1836-180-0x0000000000000000-mapping.dmp
-
memory/1900-193-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/1900-192-0x0000000000000000-mapping.dmp
-
memory/2184-171-0x0000000000000000-mapping.dmp
-
memory/2184-172-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/2188-174-0x0000000000000000-mapping.dmp
-
memory/2188-175-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/2708-177-0x0000000000000000-mapping.dmp
-
memory/2708-178-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/3168-189-0x0000000000000000-mapping.dmp
-
memory/3168-190-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/3348-187-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/3348-186-0x0000000000000000-mapping.dmp
-
memory/3616-184-0x0000000000890000-0x000000000156B000-memory.dmpFilesize
12.9MB
-
memory/3616-183-0x0000000000000000-mapping.dmp
-
memory/3912-162-0x000001F39C050000-0x000001F39C051000-memory.dmpFilesize
4KB
-
memory/3912-152-0x000001F39C230000-0x000001F39C231000-memory.dmpFilesize
4KB
-
memory/3912-141-0x000001F39C010000-0x000001F39C011000-memory.dmpFilesize
4KB
-
memory/3912-138-0x000001F399B93000-0x000001F399B95000-memory.dmpFilesize
8KB
-
memory/3912-205-0x000001F399B98000-0x000001F399B99000-memory.dmpFilesize
4KB
-
memory/3912-204-0x000001F399B96000-0x000001F399B98000-memory.dmpFilesize
8KB
-
memory/3912-137-0x000001F399B90000-0x000001F399B92000-memory.dmpFilesize
8KB
-
memory/3912-121-0x000001F39BB70000-0x000001F39BB71000-memory.dmpFilesize
4KB