Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2022 07:10
Static task
static1
Behavioral task
behavioral1
Sample
83970b7564a4bb507d9d764a747bb4e4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
83970b7564a4bb507d9d764a747bb4e4.exe
Resource
win10v2004-20220812-en
General
-
Target
83970b7564a4bb507d9d764a747bb4e4.exe
-
Size
433KB
-
MD5
83970b7564a4bb507d9d764a747bb4e4
-
SHA1
baa8dec2502aa980085a0472a6c122bd4af64ea6
-
SHA256
9d33270d80f2ba9d898b0b646dbaade5e1ad2de477e58cfcce74272d60a7473d
-
SHA512
251ddb825041332e89c5edb3fab35a2210f0f0ac6b8868872a44c9d731da446b960ba114226b2bafe71dc85a4c20d1122757660f6f1abd0ecd1821e598a6177b
-
SSDEEP
6144:5Llcs/PqcPPee+4DEZqVUMzuh3AdfLZUwIHccPyOz2bLNARo4ol8FzInD3:3yo4BAdtUwIHfyOuLNmonOBID3
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tmp7C88.tmp.exetmp7C88.tmp.exepid process 4824 tmp7C88.tmp.exe 2524 tmp7C88.tmp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
83970b7564a4bb507d9d764a747bb4e4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 83970b7564a4bb507d9d764a747bb4e4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
83970b7564a4bb507d9d764a747bb4e4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\dllhost.exe" 83970b7564a4bb507d9d764a747bb4e4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp7C88.tmp.exedescription pid process target process PID 4824 set thread context of 2524 4824 tmp7C88.tmp.exe tmp7C88.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
83970b7564a4bb507d9d764a747bb4e4.exepid process 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe 3236 83970b7564a4bb507d9d764a747bb4e4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
83970b7564a4bb507d9d764a747bb4e4.exedescription pid process Token: SeDebugPrivilege 3236 83970b7564a4bb507d9d764a747bb4e4.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
83970b7564a4bb507d9d764a747bb4e4.exetmp7C88.tmp.exedescription pid process target process PID 3236 wrote to memory of 4824 3236 83970b7564a4bb507d9d764a747bb4e4.exe tmp7C88.tmp.exe PID 3236 wrote to memory of 4824 3236 83970b7564a4bb507d9d764a747bb4e4.exe tmp7C88.tmp.exe PID 3236 wrote to memory of 4824 3236 83970b7564a4bb507d9d764a747bb4e4.exe tmp7C88.tmp.exe PID 4824 wrote to memory of 2524 4824 tmp7C88.tmp.exe tmp7C88.tmp.exe PID 4824 wrote to memory of 2524 4824 tmp7C88.tmp.exe tmp7C88.tmp.exe PID 4824 wrote to memory of 2524 4824 tmp7C88.tmp.exe tmp7C88.tmp.exe PID 4824 wrote to memory of 2524 4824 tmp7C88.tmp.exe tmp7C88.tmp.exe PID 4824 wrote to memory of 2524 4824 tmp7C88.tmp.exe tmp7C88.tmp.exe PID 4824 wrote to memory of 2524 4824 tmp7C88.tmp.exe tmp7C88.tmp.exe PID 4824 wrote to memory of 2524 4824 tmp7C88.tmp.exe tmp7C88.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83970b7564a4bb507d9d764a747bb4e4.exe"C:\Users\Admin\AppData\Local\Temp\83970b7564a4bb507d9d764a747bb4e4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7C88.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7C88.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7C88.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7C88.tmp.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7C88.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp7C88.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp7C88.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
memory/2524-138-0x0000000000000000-mapping.dmp
-
memory/2524-139-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2524-141-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3236-132-0x0000000000FC0000-0x0000000001032000-memory.dmpFilesize
456KB
-
memory/3236-133-0x00007FFC18090000-0x00007FFC18B51000-memory.dmpFilesize
10.8MB
-
memory/3236-142-0x00007FFC18090000-0x00007FFC18B51000-memory.dmpFilesize
10.8MB
-
memory/4824-134-0x0000000000000000-mapping.dmp
-
memory/4824-137-0x0000000000C20000-0x0000000000C23000-memory.dmpFilesize
12KB