Analysis Overview
SHA256
7513d19dab3fc25a8276ec33132b9114856e01c67c90dbd0318c7aa6dc2b3561
Threat Level: Known bad
The file ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.zip was found to be: Known bad.
Malicious Activity Summary
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Generic gate .php GET with minimal headers
Colibri Loader
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Win32/Colibri Loader Activity M2
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Win32/Colibri Loader Activity
suricata: ET MALWARE Win32/Colibri Loader Activity M3
Downloads MZ/PE file
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Delays execution with timeout.exe
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-07-06 18:30
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-07-06 18:30
Reported
2022-07-06 18:33
Platform
win7-20220414-en
Max time kernel
36s
Max time network
40s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe
"C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2022-07-06 18:30
Reported
2022-07-06 18:33
Platform
win10v2004-20220414-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Colibri Loader
suricata: ET MALWARE Generic gate .php GET with minimal headers
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Win32/Colibri Loader Activity
suricata: ET MALWARE Win32/Colibri Loader Activity M2
suricata: ET MALWARE Win32/Colibri Loader Activity M3
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\signed.exe | N/A |
| N/A | N/A | C:\ProgramData\MsDrvSrvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\mnr.exe | N/A |
| N/A | N/A | C:\ProgramData\sfsxzipper\cloudwindrar.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\mnr.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Service = "C:\\ProgramData\\MsDrvSrvc.exe" | C:\Users\Admin\AppData\Local\Temp\signed.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cloudwindrar-System-API = "C:\\ProgramData\\sfsxzipper\\cloudwindrar.exe" | C:\Users\Admin\AppData\Local\Temp\mnr.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | C:\Users\Admin\AppData\Local\Temp\signed.exe | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\mnr.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\mnr.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\ProgramData\sfsxzipper\cloudwindrar.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\ProgramData\sfsxzipper\cloudwindrar.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe
"C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe"
C:\Windows\SysWOW64\schtasks.exe
/create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "powershell.exe -windowstyle hidden"
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe" Name host ValueOnly True
C:\Users\Admin\AppData\Local\Temp\signed.exe
"C:\Users\Admin\AppData\Local\Temp\signed.exe"
C:\ProgramData\MsDrvSrvc.exe
"C:\ProgramData\MsDrvSrvc.exe"
C:\Users\Admin\AppData\Local\Temp\mnr.exe
"C:\Users\Admin\AppData\Local\Temp\mnr.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks.exe" /create /tn cloudwindrar-System-API /tr "C:\ProgramData\sfsxzipper\cloudwindrar.exe" /st 20:37 /du 23:59 /sc daily /ri 1 /f
C:\ProgramData\sfsxzipper\cloudwindrar.exe
"C:\ProgramData\sfsxzipper\cloudwindrar.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9441.tmp.bat""
C:\Windows\system32\timeout.exe
timeout 6
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc | udp |
| FI | 65.108.213.210:80 | zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc | tcp |
| FI | 65.108.213.210:80 | zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc | tcp |
| RU | 176.124.204.171:8000 | 176.124.204.171 | tcp |
| US | 8.248.21.254:80 | tcp | |
| US | 8.248.21.254:80 | tcp | |
| IE | 13.69.239.72:443 | tcp | |
| US | 8.248.21.254:80 | tcp | |
| US | 8.248.21.254:80 | tcp | |
| US | 8.248.21.254:80 | tcp | |
| FI | 65.108.213.210:80 | zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc | tcp |
| RU | 176.124.204.171:8000 | 176.124.204.171 | tcp |
| US | 8.8.8.8:53 | servergame00000ytty.serveminecraft.net | udp |
| FI | 65.108.213.210:80 | zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc | tcp |
| FI | 65.108.213.210:80 | zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc | tcp |
Files
memory/3116-130-0x000000007FE20000-0x000000007FE27000-memory.dmp
memory/1956-131-0x0000000000000000-mapping.dmp
memory/4396-132-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
| MD5 | 5a8bc676cf03b77f3d81a2907119d4d5 |
| SHA1 | 2114152d909c30d68af23c8526df2599c94d87cc |
| SHA256 | ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae |
| SHA512 | ee500b493c0062e69b2fa9d90ed0e5e64049aecddd37fdec19f36e6d5d8562dd6f5f2d5c32216061da640e09bf943a9f1c94777869dc7db260276becbed711db |
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
| MD5 | 5a8bc676cf03b77f3d81a2907119d4d5 |
| SHA1 | 2114152d909c30d68af23c8526df2599c94d87cc |
| SHA256 | ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae |
| SHA512 | ee500b493c0062e69b2fa9d90ed0e5e64049aecddd37fdec19f36e6d5d8562dd6f5f2d5c32216061da640e09bf943a9f1c94777869dc7db260276becbed711db |
memory/3116-135-0x000000007FE20000-0x000000007FE27000-memory.dmp
memory/4396-136-0x000000007FAB0000-0x000000007FAB7000-memory.dmp
memory/2708-137-0x0000028055820000-0x0000028055842000-memory.dmp
memory/2708-138-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp
memory/2708-139-0x000002806F2C0000-0x000002806F304000-memory.dmp
memory/2708-140-0x000002806F5A0000-0x000002806F616000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
| MD5 | 5a8bc676cf03b77f3d81a2907119d4d5 |
| SHA1 | 2114152d909c30d68af23c8526df2599c94d87cc |
| SHA256 | ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae |
| SHA512 | ee500b493c0062e69b2fa9d90ed0e5e64049aecddd37fdec19f36e6d5d8562dd6f5f2d5c32216061da640e09bf943a9f1c94777869dc7db260276becbed711db |
memory/4816-141-0x0000000000000000-mapping.dmp
memory/4816-143-0x000000007EE80000-0x000000007EE87000-memory.dmp
memory/2708-144-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp
memory/2260-145-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\signed.exe
| MD5 | 9216f18d38d88e8693c23522e5599233 |
| SHA1 | efa9f4a1f3bac7d47f1f87a7979cdbc041a24541 |
| SHA256 | 73631825f61c5f3c30c79e2edbc164e378e38c82ee0047c3de4be4f979227701 |
| SHA512 | 569cc6d1cf58932427e24f70a48f718e1ae00e9673ba3b206c4dc5cf22a727fd33ba1228fa97dd9ceed89212350c0125c112539e5c44506cc642a878150daed3 |
C:\Users\Admin\AppData\Local\Temp\signed.exe
| MD5 | 9216f18d38d88e8693c23522e5599233 |
| SHA1 | efa9f4a1f3bac7d47f1f87a7979cdbc041a24541 |
| SHA256 | 73631825f61c5f3c30c79e2edbc164e378e38c82ee0047c3de4be4f979227701 |
| SHA512 | 569cc6d1cf58932427e24f70a48f718e1ae00e9673ba3b206c4dc5cf22a727fd33ba1228fa97dd9ceed89212350c0125c112539e5c44506cc642a878150daed3 |
memory/4436-148-0x0000000000000000-mapping.dmp
C:\ProgramData\MsDrvSrvc.exe
| MD5 | 9216f18d38d88e8693c23522e5599233 |
| SHA1 | efa9f4a1f3bac7d47f1f87a7979cdbc041a24541 |
| SHA256 | 73631825f61c5f3c30c79e2edbc164e378e38c82ee0047c3de4be4f979227701 |
| SHA512 | 569cc6d1cf58932427e24f70a48f718e1ae00e9673ba3b206c4dc5cf22a727fd33ba1228fa97dd9ceed89212350c0125c112539e5c44506cc642a878150daed3 |
C:\ProgramData\MsDrvSrvc.exe
| MD5 | 9216f18d38d88e8693c23522e5599233 |
| SHA1 | efa9f4a1f3bac7d47f1f87a7979cdbc041a24541 |
| SHA256 | 73631825f61c5f3c30c79e2edbc164e378e38c82ee0047c3de4be4f979227701 |
| SHA512 | 569cc6d1cf58932427e24f70a48f718e1ae00e9673ba3b206c4dc5cf22a727fd33ba1228fa97dd9ceed89212350c0125c112539e5c44506cc642a878150daed3 |
memory/4520-151-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\mnr.exe
| MD5 | 1809e89d7914b9da7071b04d6aca57f3 |
| SHA1 | d005795761e1b53fa2495f290f64b699b3e8c189 |
| SHA256 | d5d3b50be1f0ba6f790adb1ca36f46133bd6878774bc6eac441be4db1b1c29c5 |
| SHA512 | 0faa90d69699cf9bc54f269e40086c09ba745324e77975c715ea6be84e33b3bf4f2afe4b26a22c9c721fc1592974d0084484743daf09683ac65a80207c2b8554 |
C:\Users\Admin\AppData\Local\Temp\mnr.exe
| MD5 | 1809e89d7914b9da7071b04d6aca57f3 |
| SHA1 | d005795761e1b53fa2495f290f64b699b3e8c189 |
| SHA256 | d5d3b50be1f0ba6f790adb1ca36f46133bd6878774bc6eac441be4db1b1c29c5 |
| SHA512 | 0faa90d69699cf9bc54f269e40086c09ba745324e77975c715ea6be84e33b3bf4f2afe4b26a22c9c721fc1592974d0084484743daf09683ac65a80207c2b8554 |
memory/4520-154-0x00000000007B0000-0x00000000007E0000-memory.dmp
memory/4520-155-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp
memory/4756-156-0x0000000000000000-mapping.dmp
memory/3340-157-0x0000000000000000-mapping.dmp
C:\ProgramData\sfsxzipper\cloudwindrar.exe
| MD5 | 1809e89d7914b9da7071b04d6aca57f3 |
| SHA1 | d005795761e1b53fa2495f290f64b699b3e8c189 |
| SHA256 | d5d3b50be1f0ba6f790adb1ca36f46133bd6878774bc6eac441be4db1b1c29c5 |
| SHA512 | 0faa90d69699cf9bc54f269e40086c09ba745324e77975c715ea6be84e33b3bf4f2afe4b26a22c9c721fc1592974d0084484743daf09683ac65a80207c2b8554 |
C:\ProgramData\sfsxzipper\cloudwindrar.exe
| MD5 | 1809e89d7914b9da7071b04d6aca57f3 |
| SHA1 | d005795761e1b53fa2495f290f64b699b3e8c189 |
| SHA256 | d5d3b50be1f0ba6f790adb1ca36f46133bd6878774bc6eac441be4db1b1c29c5 |
| SHA512 | 0faa90d69699cf9bc54f269e40086c09ba745324e77975c715ea6be84e33b3bf4f2afe4b26a22c9c721fc1592974d0084484743daf09683ac65a80207c2b8554 |
memory/3436-160-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\tmp9441.tmp.bat
| MD5 | 58c5d6c11263d0e6075d44d02c066e34 |
| SHA1 | f2cfc86fe0c2c59f4528e46a95df7826cf02f1c3 |
| SHA256 | 7855783aa02e1db6b66681f58d2d02b525470f177040948336f14471a36f9ad4 |
| SHA512 | a85fd095b6c3bbce2391e96d766698caaf3773c11c4935bd86bbd47ba13c5cd97724e3b4a68f4504d65a24e8b5c2073420ced93b99717a28f0b5f81c14645e01 |
memory/2908-162-0x0000000000000000-mapping.dmp
memory/4520-163-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp
memory/3340-164-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp
memory/3340-165-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp