Analysis
-
max time kernel
130s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2022 11:13
Static task
static1
Behavioral task
behavioral1
Sample
0f825e504d181de431550ae732e1bc49.exe
Resource
win7-20220718-en
General
-
Target
0f825e504d181de431550ae732e1bc49.exe
-
Size
399KB
-
MD5
0f825e504d181de431550ae732e1bc49
-
SHA1
829eee9072fec9a8cd750add714b3fde39c4034b
-
SHA256
1c097578d9587bd8a233bd383ec71123b03c75b582dcc7e8f5c085e05d32cd3d
-
SHA512
f516b5a6987fcc36bdec18590a2cb8d563afe0bdf20ad641a72a98eb21051a7e62d698000606807dbcd335f1edf0843a0885444bb891068d360bc5ce44cd5ca3
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
tmp75A2.tmp.exetmp75A2.tmp.exeGet-Variable.exeGet-Variable.exeGet-Variable.exeGet-Variable.exepid process 4912 tmp75A2.tmp.exe 5028 tmp75A2.tmp.exe 4864 Get-Variable.exe 1828 Get-Variable.exe 3000 Get-Variable.exe 4728 Get-Variable.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0f825e504d181de431550ae732e1bc49.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 0f825e504d181de431550ae732e1bc49.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp75A2.tmp.exeGet-Variable.exeGet-Variable.exedescription pid process target process PID 4912 set thread context of 5028 4912 tmp75A2.tmp.exe tmp75A2.tmp.exe PID 4864 set thread context of 1828 4864 Get-Variable.exe Get-Variable.exe PID 3000 set thread context of 4728 3000 Get-Variable.exe Get-Variable.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0f825e504d181de431550ae732e1bc49.exepid process 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe 3380 0f825e504d181de431550ae732e1bc49.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0f825e504d181de431550ae732e1bc49.exepowershell.exedescription pid process Token: SeDebugPrivilege 3380 0f825e504d181de431550ae732e1bc49.exe Token: SeDebugPrivilege 4324 powershell.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
0f825e504d181de431550ae732e1bc49.exetmp75A2.tmp.exetmp75A2.tmp.exeGet-Variable.exepowershell.exeGet-Variable.exedescription pid process target process PID 3380 wrote to memory of 4912 3380 0f825e504d181de431550ae732e1bc49.exe tmp75A2.tmp.exe PID 3380 wrote to memory of 4912 3380 0f825e504d181de431550ae732e1bc49.exe tmp75A2.tmp.exe PID 3380 wrote to memory of 4912 3380 0f825e504d181de431550ae732e1bc49.exe tmp75A2.tmp.exe PID 4912 wrote to memory of 5028 4912 tmp75A2.tmp.exe tmp75A2.tmp.exe PID 4912 wrote to memory of 5028 4912 tmp75A2.tmp.exe tmp75A2.tmp.exe PID 4912 wrote to memory of 5028 4912 tmp75A2.tmp.exe tmp75A2.tmp.exe PID 4912 wrote to memory of 5028 4912 tmp75A2.tmp.exe tmp75A2.tmp.exe PID 4912 wrote to memory of 5028 4912 tmp75A2.tmp.exe tmp75A2.tmp.exe PID 4912 wrote to memory of 5028 4912 tmp75A2.tmp.exe tmp75A2.tmp.exe PID 4912 wrote to memory of 5028 4912 tmp75A2.tmp.exe tmp75A2.tmp.exe PID 5028 wrote to memory of 5012 5028 tmp75A2.tmp.exe schtasks.exe PID 5028 wrote to memory of 5012 5028 tmp75A2.tmp.exe schtasks.exe PID 5028 wrote to memory of 5012 5028 tmp75A2.tmp.exe schtasks.exe PID 5028 wrote to memory of 4864 5028 tmp75A2.tmp.exe Get-Variable.exe PID 5028 wrote to memory of 4864 5028 tmp75A2.tmp.exe Get-Variable.exe PID 5028 wrote to memory of 4864 5028 tmp75A2.tmp.exe Get-Variable.exe PID 4864 wrote to memory of 1828 4864 Get-Variable.exe Get-Variable.exe PID 4864 wrote to memory of 1828 4864 Get-Variable.exe Get-Variable.exe PID 4864 wrote to memory of 1828 4864 Get-Variable.exe Get-Variable.exe PID 4864 wrote to memory of 1828 4864 Get-Variable.exe Get-Variable.exe PID 4864 wrote to memory of 1828 4864 Get-Variable.exe Get-Variable.exe PID 4864 wrote to memory of 1828 4864 Get-Variable.exe Get-Variable.exe PID 4864 wrote to memory of 1828 4864 Get-Variable.exe Get-Variable.exe PID 4324 wrote to memory of 3000 4324 powershell.exe Get-Variable.exe PID 4324 wrote to memory of 3000 4324 powershell.exe Get-Variable.exe PID 4324 wrote to memory of 3000 4324 powershell.exe Get-Variable.exe PID 3000 wrote to memory of 4728 3000 Get-Variable.exe Get-Variable.exe PID 3000 wrote to memory of 4728 3000 Get-Variable.exe Get-Variable.exe PID 3000 wrote to memory of 4728 3000 Get-Variable.exe Get-Variable.exe PID 3000 wrote to memory of 4728 3000 Get-Variable.exe Get-Variable.exe PID 3000 wrote to memory of 4728 3000 Get-Variable.exe Get-Variable.exe PID 3000 wrote to memory of 4728 3000 Get-Variable.exe Get-Variable.exe PID 3000 wrote to memory of 4728 3000 Get-Variable.exe Get-Variable.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f825e504d181de431550ae732e1bc49.exe"C:\Users\Admin\AppData\Local\Temp\0f825e504d181de431550ae732e1bc49.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp75A2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp75A2.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp75A2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp75A2.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "powershell.exe -windowstyle hidden"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe" Name host ValueOnly True2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Temp\tmp75A2.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Temp\tmp75A2.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
C:\Users\Admin\AppData\Local\Temp\tmp75A2.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
memory/1828-148-0x0000000000000000-mapping.dmp
-
memory/3000-157-0x0000000000000000-mapping.dmp
-
memory/3000-159-0x0000000000B23000-0x0000000000B29000-memory.dmpFilesize
24KB
-
memory/3380-139-0x000000001F2A0000-0x000000001F3AA000-memory.dmpFilesize
1.0MB
-
memory/3380-143-0x00007FFBB0810000-0x00007FFBB12D1000-memory.dmpFilesize
10.8MB
-
memory/3380-154-0x000000001F160000-0x000000001F1B0000-memory.dmpFilesize
320KB
-
memory/3380-141-0x000000001F220000-0x000000001F25C000-memory.dmpFilesize
240KB
-
memory/3380-130-0x0000000000EF0000-0x0000000000F56000-memory.dmpFilesize
408KB
-
memory/3380-140-0x000000001F1C0000-0x000000001F1D2000-memory.dmpFilesize
72KB
-
memory/3380-166-0x00007FFBB0810000-0x00007FFBB12D1000-memory.dmpFilesize
10.8MB
-
memory/3380-131-0x00007FFBB0810000-0x00007FFBB12D1000-memory.dmpFilesize
10.8MB
-
memory/3380-165-0x0000000020740000-0x0000000020C68000-memory.dmpFilesize
5.2MB
-
memory/3380-164-0x0000000020040000-0x0000000020202000-memory.dmpFilesize
1.8MB
-
memory/3380-152-0x000000001CC00000-0x000000001CC76000-memory.dmpFilesize
472KB
-
memory/3380-153-0x000000001CBA0000-0x000000001CBBE000-memory.dmpFilesize
120KB
-
memory/4324-155-0x000001A73F210000-0x000001A73F232000-memory.dmpFilesize
136KB
-
memory/4324-163-0x00007FFBB0810000-0x00007FFBB12D1000-memory.dmpFilesize
10.8MB
-
memory/4324-156-0x000001A7401B0000-0x000001A7401F4000-memory.dmpFilesize
272KB
-
memory/4324-167-0x00007FFBB0810000-0x00007FFBB12D1000-memory.dmpFilesize
10.8MB
-
memory/4728-160-0x0000000000000000-mapping.dmp
-
memory/4864-145-0x0000000000000000-mapping.dmp
-
memory/4912-132-0x0000000000000000-mapping.dmp
-
memory/4912-135-0x00000000004C2000-0x00000000004C8000-memory.dmpFilesize
24KB
-
memory/5012-144-0x0000000000000000-mapping.dmp
-
memory/5028-136-0x0000000000000000-mapping.dmp
-
memory/5028-142-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/5028-151-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/5028-137-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB