Analysis
-
max time kernel
93s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-09-2022 14:06
Static task
static1
Behavioral task
behavioral1
Sample
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe
Resource
win10v2004-20220812-en
General
-
Target
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe
-
Size
602KB
-
MD5
913240d24664aeeee23dcf389d6f2ce9
-
SHA1
730b13fb29347ee478d79195e49977de41ed740f
-
SHA256
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc
-
SHA512
8a7e73fc3214dccdbea8a5f6a70b40f233719b2a7ce8bd205d3be2f01c93412d788fea071020dbbd76d79c43352fb71f60dab0e8eec18b159d5d0f970ad7bde7
-
SSDEEP
6144:up/J6DzcxdUf4/p6gj59aG5Ye5fYNYPk30QRyzpGa+IZ:up/J6DzudUw/t9Ge5fYlEQRyzwrG
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
conhost.execonhost.exepid process 4796 conhost.exe 4708 conhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdge = "C:\\Users\\Admin\\AppData\\Roaming\\MSEdge\\msedge.exe" 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.execonhost.exe9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exedescription pid process target process PID 3580 set thread context of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4796 set thread context of 4708 4796 conhost.exe conhost.exe PID 4732 set thread context of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 3716 cmd.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.execonhost.exe9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exedescription pid process target process PID 3580 wrote to memory of 4796 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe conhost.exe PID 3580 wrote to memory of 4796 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe conhost.exe PID 3580 wrote to memory of 4796 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe conhost.exe PID 4796 wrote to memory of 4708 4796 conhost.exe conhost.exe PID 4796 wrote to memory of 4708 4796 conhost.exe conhost.exe PID 4796 wrote to memory of 4708 4796 conhost.exe conhost.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 3580 wrote to memory of 4732 3580 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4796 wrote to memory of 4708 4796 conhost.exe conhost.exe PID 4796 wrote to memory of 4708 4796 conhost.exe conhost.exe PID 4796 wrote to memory of 4708 4796 conhost.exe conhost.exe PID 4796 wrote to memory of 4708 4796 conhost.exe conhost.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4732 wrote to memory of 4440 4732 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe PID 4440 wrote to memory of 3716 4440 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe cmd.exe PID 4440 wrote to memory of 3716 4440 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe cmd.exe PID 4440 wrote to memory of 3716 4440 9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe"C:\Users\Admin\AppData\Local\Temp\9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe"C:\Users\Admin\AppData\Local\Temp\9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe"C:\Users\Admin\AppData\Local\Temp\9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
memory/3580-134-0x0000000001015000-0x0000000001028000-memory.dmpFilesize
76KB
-
memory/3716-157-0x0000000000000000-mapping.dmp
-
memory/4440-147-0x0000000000180000-0x00000000001B6000-memory.dmpFilesize
216KB
-
memory/4440-146-0x0000000000000000-mapping.dmp
-
memory/4440-155-0x0000000000180000-0x00000000001B6000-memory.dmpFilesize
216KB
-
memory/4440-152-0x0000000000180000-0x00000000001B6000-memory.dmpFilesize
216KB
-
memory/4708-139-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4708-136-0x0000000000000000-mapping.dmp
-
memory/4708-156-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4732-149-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4732-142-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4732-141-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4732-143-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4732-138-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4732-137-0x0000000000000000-mapping.dmp
-
memory/4796-132-0x0000000000000000-mapping.dmp