colibri | 566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0a27c61bd92f511efe76

General

Target

566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
Size

794KB
MD5

9c038c34e4d37410cecb1f20f90984d5
SHA1

ad16dea0d1f1d3eb45e8d8e1a040e42110ab1bec
SHA256

566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0a27c61bd92f511efe76
SHA512

5e5a5b357fe902b76b8c76a534904cc4ab588d9e558c1c5a6ad935326fa532873a27f6b1c9dd6c62aecc84ac791cc2442c9ef41c4151077d7499ed7c7e59b961
SSDEEP

6144:gHsV9Ig0yuLxcxxHz9Fl5iD4n3HVxx+BcUg+4oyss3MAy8IfSEA6gsumifLzJ6:4svBPnHJ5iERUghGUMAOSElgsumiT

Score

10^/10

colibri build1 discovery loader spyware stealer

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Executes dropped EXE 2 IoCs

Processes:

tmp8BCA.tmp.exetmp8BCA.tmp.exe

pid process

2608 tmp8BCA.tmp.exe
4952 tmp8BCA.tmp.exe

pid	process
2608	tmp8BCA.tmp.exe
4952	tmp8BCA.tmp.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp8BCA.tmp.exe

description pid process target process

PID 2608 set thread context of 4952 2608 tmp8BCA.tmp.exe tmp8BCA.tmp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 2608 set thread context of 4952	2608	tmp8BCA.tmp.exe	tmp8BCA.tmp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe

pid	process
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe

description pid process

Token: SeDebugPrivilege 1120 566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe

description	pid	process
Token: SeDebugPrivilege	1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exetmp8BCA.tmp.exe

description	pid	process	target process
PID 1120 wrote to memory of 2608	1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe	tmp8BCA.tmp.exe
PID 1120 wrote to memory of 2608	1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe	tmp8BCA.tmp.exe
PID 1120 wrote to memory of 2608	1120	566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe	tmp8BCA.tmp.exe
PID 2608 wrote to memory of 4952	2608	tmp8BCA.tmp.exe	tmp8BCA.tmp.exe
PID 2608 wrote to memory of 4952	2608	tmp8BCA.tmp.exe	tmp8BCA.tmp.exe
PID 2608 wrote to memory of 4952	2608	tmp8BCA.tmp.exe	tmp8BCA.tmp.exe
PID 2608 wrote to memory of 4952	2608	tmp8BCA.tmp.exe	tmp8BCA.tmp.exe
PID 2608 wrote to memory of 4952	2608	tmp8BCA.tmp.exe	tmp8BCA.tmp.exe
PID 2608 wrote to memory of 4952	2608	tmp8BCA.tmp.exe	tmp8BCA.tmp.exe
PID 2608 wrote to memory of 4952	2608	tmp8BCA.tmp.exe	tmp8BCA.tmp.exe

C:\Users\Admin\AppData\Local\Temp\566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe
"C:\Users\Admin\AppData\Local\Temp\566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120

C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2608

C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmp.exe"
3⤵
- Executes dropped EXE
PID:4952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8BCA.tmp.exe

Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
memory/1120-135-0x00007FFE80D30000-0x00007FFE817F1000-memory.dmp

Filesize
10.8MB

Download
memory/1120-136-0x0000000000C40000-0x0000000000C7C000-memory.dmp

Filesize
240KB

Download
memory/1120-132-0x0000000000370000-0x000000000043C000-memory.dmp

Filesize
816KB

Download
memory/1120-147-0x000000001CA20000-0x000000001CA96000-memory.dmp

Filesize
472KB

Download
memory/1120-134-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

Filesize
72KB

Download
memory/1120-152-0x00007FFE80D30000-0x00007FFE817F1000-memory.dmp

Filesize
10.8MB

Download
memory/1120-151-0x000000001E3E0000-0x000000001E908000-memory.dmp

Filesize
5.2MB

Download
memory/1120-150-0x000000001DCE0000-0x000000001DEA2000-memory.dmp

Filesize
1.8MB

Download
memory/1120-133-0x000000001BF40000-0x000000001C04A000-memory.dmp

Filesize
1.0MB

Download
memory/1120-149-0x000000001D850000-0x000000001D8A0000-memory.dmp

Filesize
320KB

Download
memory/1120-145-0x00007FFE80D30000-0x00007FFE817F1000-memory.dmp

Filesize
10.8MB

Download
memory/1120-148-0x000000001B460000-0x000000001B47E000-memory.dmp

Filesize
120KB

Download
memory/2608-137-0x0000000000000000-mapping.dmp

Download
memory/2608-140-0x00000000009F1000-0x00000000009F4000-memory.dmp

Filesize
12KB

Download
memory/4952-146-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4952-144-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4952-142-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4952-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads