Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2022 11:14
Static task
static1
Behavioral task
behavioral1
Sample
9c512797b50b536a82baf18fc9fb3077.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9c512797b50b536a82baf18fc9fb3077.exe
Resource
win10v2004-20220812-en
General
-
Target
9c512797b50b536a82baf18fc9fb3077.exe
-
Size
602KB
-
MD5
9c512797b50b536a82baf18fc9fb3077
-
SHA1
bd9fc65cb2d62474e510c74e93e8475096661e8c
-
SHA256
5ba33d60c4483c65ed0515ab6068a7bd3d429dd80392aa4864070a08c42223c5
-
SHA512
e20abf9a3a0e6d482cc68b8dd6ba809cb3f5dee3e5f326ff05e38fa565f51a8f65b4338bc84fecc871275a6538a401909cbc87fda5e0a852bb6cff06a356ee53
-
SSDEEP
6144:BBcIhrEveSkYMiYV3URBSDdZgBNAtFySYODL8QS:B/hroLMP3kEgBNAt2QL8QS
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
conhost.execonhost.exepid process 980 conhost.exe 4524 conhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9c512797b50b536a82baf18fc9fb3077.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run 9c512797b50b536a82baf18fc9fb3077.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdge = "C:\\Users\\Admin\\AppData\\Roaming\\MSEdge\\msedge.exe" 9c512797b50b536a82baf18fc9fb3077.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9c512797b50b536a82baf18fc9fb3077.execonhost.exe9c512797b50b536a82baf18fc9fb3077.exedescription pid process target process PID 684 set thread context of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 980 set thread context of 4524 980 conhost.exe conhost.exe PID 1268 set thread context of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 376 cmd.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
9c512797b50b536a82baf18fc9fb3077.execonhost.exe9c512797b50b536a82baf18fc9fb3077.exe9c512797b50b536a82baf18fc9fb3077.exedescription pid process target process PID 684 wrote to memory of 980 684 9c512797b50b536a82baf18fc9fb3077.exe conhost.exe PID 684 wrote to memory of 980 684 9c512797b50b536a82baf18fc9fb3077.exe conhost.exe PID 684 wrote to memory of 980 684 9c512797b50b536a82baf18fc9fb3077.exe conhost.exe PID 980 wrote to memory of 4524 980 conhost.exe conhost.exe PID 980 wrote to memory of 4524 980 conhost.exe conhost.exe PID 980 wrote to memory of 4524 980 conhost.exe conhost.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 684 wrote to memory of 1268 684 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 980 wrote to memory of 4524 980 conhost.exe conhost.exe PID 980 wrote to memory of 4524 980 conhost.exe conhost.exe PID 980 wrote to memory of 4524 980 conhost.exe conhost.exe PID 980 wrote to memory of 4524 980 conhost.exe conhost.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 1268 wrote to memory of 116 1268 9c512797b50b536a82baf18fc9fb3077.exe 9c512797b50b536a82baf18fc9fb3077.exe PID 116 wrote to memory of 376 116 9c512797b50b536a82baf18fc9fb3077.exe cmd.exe PID 116 wrote to memory of 376 116 9c512797b50b536a82baf18fc9fb3077.exe cmd.exe PID 116 wrote to memory of 376 116 9c512797b50b536a82baf18fc9fb3077.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\conhost.exe"C:\ProgramData\conhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"C:\Users\Admin\AppData\Local\Temp\9c512797b50b536a82baf18fc9fb3077.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe4⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\ProgramData\conhost.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
memory/116-146-0x0000000000000000-mapping.dmp
-
memory/116-155-0x0000000001210000-0x0000000001246000-memory.dmpFilesize
216KB
-
memory/116-152-0x0000000001210000-0x0000000001246000-memory.dmpFilesize
216KB
-
memory/116-147-0x0000000001210000-0x0000000001246000-memory.dmpFilesize
216KB
-
memory/376-157-0x0000000000000000-mapping.dmp
-
memory/684-133-0x0000000001195000-0x00000000011A8000-memory.dmpFilesize
76KB
-
memory/980-132-0x0000000000000000-mapping.dmp
-
memory/1268-149-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1268-143-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1268-142-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1268-141-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1268-138-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1268-137-0x0000000000000000-mapping.dmp
-
memory/4524-136-0x0000000000000000-mapping.dmp
-
memory/4524-139-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4524-156-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB