colibri | 5ba33d60c4483c65ed0515ab6068a7bd3d429dd80392aa4864070a08c42223c5

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2022, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c512797b50b536a82baf18fc9fb3077.exe
Size 602KB
Sample220903-nbzhfseaam
SHA256 5ba33d60c4483c65ed0515ab6068a7bd3d429dd80392aa4864070a08c42223c5
MD5 9c512797b50b536a82baf18fc9fb3077
SHA1 bd9fc65cb2d62474e510c74e93e8475096661e8c
SHA512 e20abf9a3a0e6d482cc68b8dd6ba809cb3f5dee3e5f326ff05e38fa565f51a8f65b4338bc84fecc871275a6538a401909cbc87fda5e0a852bb6cff06a356ee53
SSDEEP 6144:BBcIhrEveSkYMiYV3URBSDdZgBNAtFySYODL8QS:B/hroLMP3kEgBNAt2QL8QS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

colibri build1 loader persistence

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

Executes dropped EXE 2 IoCs

pid	Process
980	conhost.exe
4524	conhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	9c512797b50b536a82baf18fc9fb3077.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdge = "C:\\Users\\Admin\\AppData\\Roaming\\MSEdge\\msedge.exe"	9c512797b50b536a82baf18fc9fb3077.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 684 set thread context of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 980 set thread context of 4524	980	conhost.exe	85
PID 1268 set thread context of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
376	cmd.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 980	684	9c512797b50b536a82baf18fc9fb3077.exe	84
PID 684 wrote to memory of 980	684	9c512797b50b536a82baf18fc9fb3077.exe	84
PID 684 wrote to memory of 980	684	9c512797b50b536a82baf18fc9fb3077.exe	84
PID 980 wrote to memory of 4524	980	conhost.exe	85
PID 980 wrote to memory of 4524	980	conhost.exe	85
PID 980 wrote to memory of 4524	980	conhost.exe	85
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 684 wrote to memory of 1268	684	9c512797b50b536a82baf18fc9fb3077.exe	86
PID 980 wrote to memory of 4524	980	conhost.exe	85
PID 980 wrote to memory of 4524	980	conhost.exe	85
PID 980 wrote to memory of 4524	980	conhost.exe	85
PID 980 wrote to memory of 4524	980	conhost.exe	85
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 1268 wrote to memory of 116	1268	9c512797b50b536a82baf18fc9fb3077.exe	87
PID 116 wrote to memory of 376	116	9c512797b50b536a82baf18fc9fb3077.exe	97
PID 116 wrote to memory of 376	116	9c512797b50b536a82baf18fc9fb3077.exe	97
PID 116 wrote to memory of 376	116	9c512797b50b536a82baf18fc9fb3077.exe	97

C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe
"C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:684
- C:\ProgramData\conhost.exe
  "C:\ProgramData\conhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\ProgramData\conhost.exe
    "C:\ProgramData\conhost.exe"
    3⤵
    - Executes dropped EXE
    PID:4524
- C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe
  "C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe
    "C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe
      4⤵
      Checks computer location settings
      Suspicious use of SetWindowsHookEx
      PID:376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

conhost.exe

Path C:\ProgramData\conhost.exe
Size 75KB
SHA256 2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
MD5 e0a68b98992c1699876f818a22b5b907
SHA1 d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA512 856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
SSDEEP 768:mdU/rTZZAG7lad6fEW1PRLqHxVR/LfXGCCMzgAprfLJh0AiyqjXJwr:mdU/rT9oTWbw/LvfHh0AliXJwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\ProgramData\conhost.exe
Size 75KB
SHA256 2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
MD5 e0a68b98992c1699876f818a22b5b907
SHA1 d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA512 856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
SSDEEP 768:mdU/rTZZAG7lad6fEW1PRLqHxVR/LfXGCCMzgAprfLJh0AiyqjXJwr:mdU/rT9oTWbw/LvfHh0AliXJwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\ProgramData\conhost.exe
Size 75KB
SHA256 2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
MD5 e0a68b98992c1699876f818a22b5b907
SHA1 d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA512 856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
SSDEEP 768:mdU/rTZZAG7lad6fEW1PRLqHxVR/LfXGCCMzgAprfLJh0AiyqjXJwr:mdU/rT9oTWbw/LvfHh0AliXJwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-155-0x0000000001210000-0x0000000001246000-memory.dmp

Download

memory/116-152-0x0000000001210000-0x0000000001246000-memory.dmp

Download

memory/116-147-0x0000000001210000-0x0000000001246000-memory.dmp

Download

memory/684-133-0x0000000001195000-0x00000000011A8000-memory.dmp

Download

memory/1268-149-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1268-143-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1268-142-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1268-141-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1268-138-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/4524-139-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4524-156-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads