Analysis
-
max time kernel
108s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2022 05:43
Static task
static1
Behavioral task
behavioral1
Sample
31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe
Resource
win10v2004-20220812-en
General
-
Target
31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe
-
Size
602KB
-
MD5
533a75352e7692b34a28738a67915adf
-
SHA1
f58115604020a34ad5a3853c9e91f957fae3021a
-
SHA256
31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91
-
SHA512
aff91444a99ca1663ffee7c42060e47bcd830b2acdc7791fb468fa581295c398c97fc7b63e2e38f0c85ae2c61bf831ec70fc3e49b8af5fce56eee33f7e73ba5b
-
SSDEEP
12288:8aHNwhpywQ4NNFNS1I5wWOXfVVIiOsTmddebmxNkV1GWcfAQwPStrWliGYQJo:N/fOLBGYQJ
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
conhost.execonhost.exepid process 2248 conhost.exe 4180 conhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdge = "C:\\Users\\Admin\\AppData\\Roaming\\MSEdge\\msedge.exe" 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
conhost.exe31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exedescription pid process target process PID 2248 set thread context of 4180 2248 conhost.exe conhost.exe PID 1952 set thread context of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 set thread context of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 3060 cmd.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.execonhost.exe31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exedescription pid process target process PID 4788 wrote to memory of 2248 4788 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe conhost.exe PID 4788 wrote to memory of 2248 4788 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe conhost.exe PID 4788 wrote to memory of 2248 4788 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe conhost.exe PID 2248 wrote to memory of 4180 2248 conhost.exe conhost.exe PID 2248 wrote to memory of 4180 2248 conhost.exe conhost.exe PID 2248 wrote to memory of 4180 2248 conhost.exe conhost.exe PID 4788 wrote to memory of 1952 4788 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4788 wrote to memory of 1952 4788 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4788 wrote to memory of 1952 4788 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 2248 wrote to memory of 4180 2248 conhost.exe conhost.exe PID 2248 wrote to memory of 4180 2248 conhost.exe conhost.exe PID 2248 wrote to memory of 4180 2248 conhost.exe conhost.exe PID 2248 wrote to memory of 4180 2248 conhost.exe conhost.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 1952 wrote to memory of 4564 1952 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4564 wrote to memory of 4828 4564 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe PID 4828 wrote to memory of 3060 4828 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe cmd.exe PID 4828 wrote to memory of 3060 4828 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe cmd.exe PID 4828 wrote to memory of 3060 4828 31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe"C:\Users\Admin\AppData\Local\Temp\31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe"C:\Users\Admin\AppData\Local\Temp\31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe"C:\Users\Admin\AppData\Local\Temp\31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe"C:\Users\Admin\AppData\Local\Temp\31e2235fd61e64986d698dd1b8cb11c494b05d575886ccfcc437094735401e91.exe"4⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe5⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
memory/1952-140-0x0000000000838000-0x000000000084B000-memory.dmpFilesize
76KB
-
memory/1952-136-0x0000000000000000-mapping.dmp
-
memory/2248-132-0x0000000000000000-mapping.dmp
-
memory/3060-160-0x0000000000000000-mapping.dmp
-
memory/4180-139-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4180-137-0x0000000000000000-mapping.dmp
-
memory/4180-159-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4564-153-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4564-142-0x0000000000000000-mapping.dmp
-
memory/4564-143-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4564-145-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4564-144-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4564-146-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4788-138-0x0000000000728000-0x000000000072A000-memory.dmpFilesize
8KB
-
memory/4788-133-0x00000000007F5000-0x0000000000808000-memory.dmpFilesize
76KB
-
memory/4828-150-0x0000000000E50000-0x0000000000E86000-memory.dmpFilesize
216KB
-
memory/4828-155-0x0000000000E50000-0x0000000000E86000-memory.dmpFilesize
216KB
-
memory/4828-158-0x0000000000E50000-0x0000000000E86000-memory.dmpFilesize
216KB
-
memory/4828-149-0x0000000000000000-mapping.dmp