colibri | 566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0a27c61bd92f511efe76

General

Target

tmp.exe
Size

794KB
MD5

9c038c34e4d37410cecb1f20f90984d5
SHA1

ad16dea0d1f1d3eb45e8d8e1a040e42110ab1bec
SHA256

566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0a27c61bd92f511efe76
SHA512

5e5a5b357fe902b76b8c76a534904cc4ab588d9e558c1c5a6ad935326fa532873a27f6b1c9dd6c62aecc84ac791cc2442c9ef41c4151077d7499ed7c7e59b961
SSDEEP

6144:gHsV9Ig0yuLxcxxHz9Fl5iD4n3HVxx+BcUg+4oyss3MAy8IfSEA6gsumifLzJ6:4svBPnHJ5iERUghGUMAOSElgsumiT

Score

10^/10

colibri build1 discovery loader spyware stealer

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Executes dropped EXE 3 IoCs

Processes:

tmpD7D.tmp.exetmpD7D.tmp.exetmpD7D.tmp.exe

pid process

4896 tmpD7D.tmp.exe
3884 tmpD7D.tmp.exe
3236 tmpD7D.tmp.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

tmp.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation tmp.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmpD7D.tmp.exe

description pid process target process

PID 3884 set thread context of 3236 3884 tmpD7D.tmp.exe tmpD7D.tmp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4896	tmpD7D.tmp.exe
3884	tmpD7D.tmp.exe
3236	tmpD7D.tmp.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	tmp.exe

description	pid	process	target process
PID 3884 set thread context of 3236	3884	tmpD7D.tmp.exe	tmpD7D.tmp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

tmp.exe

pid	process
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe
2248	tmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 2248 tmp.exe

description	pid	process
Token: SeDebugPrivilege	2248	tmp.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

tmp.exetmpD7D.tmp.exetmpD7D.tmp.exe

description	pid	process	target process
PID 2248 wrote to memory of 4896	2248	tmp.exe	tmpD7D.tmp.exe
PID 2248 wrote to memory of 4896	2248	tmp.exe	tmpD7D.tmp.exe
PID 2248 wrote to memory of 4896	2248	tmp.exe	tmpD7D.tmp.exe
PID 4896 wrote to memory of 3884	4896	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 4896 wrote to memory of 3884	4896	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 4896 wrote to memory of 3884	4896	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 3884 wrote to memory of 3236	3884	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 3884 wrote to memory of 3236	3884	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 3884 wrote to memory of 3236	3884	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 3884 wrote to memory of 3236	3884	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 3884 wrote to memory of 3236	3884	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 3884 wrote to memory of 3236	3884	tmpD7D.tmp.exe	tmpD7D.tmp.exe
PID 3884 wrote to memory of 3236	3884	tmpD7D.tmp.exe	tmpD7D.tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896

C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3884

C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe"
4⤵
- Executes dropped EXE
PID:3236

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD7D.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
memory/2248-147-0x0000000003070000-0x0000000003082000-memory.dmp

Filesize
72KB

Download
memory/2248-148-0x000000001BCA0000-0x000000001BCDC000-memory.dmp

Filesize
240KB

Download
memory/2248-154-0x00007FFAB6C00000-0x00007FFAB76C1000-memory.dmp

Filesize
10.8MB

Download
memory/2248-153-0x000000001EDC0000-0x000000001F2E8000-memory.dmp

Filesize
5.2MB

Download
memory/2248-152-0x000000001E6C0000-0x000000001E882000-memory.dmp

Filesize
1.8MB

Download
memory/2248-151-0x000000001D6D0000-0x000000001D720000-memory.dmp

Filesize
320KB

Download
memory/2248-150-0x000000001B980000-0x000000001B99E000-memory.dmp

Filesize
120KB

Download
memory/2248-149-0x000000001D750000-0x000000001D7C6000-memory.dmp

Filesize
472KB

Download
memory/2248-133-0x0000000000C50000-0x0000000000D1C000-memory.dmp

Filesize
816KB

Download
memory/2248-137-0x00007FFAB6C00000-0x00007FFAB76C1000-memory.dmp

Filesize
10.8MB

Download
memory/2248-146-0x000000001DEE0000-0x000000001DFEA000-memory.dmp

Filesize
1.0MB

Download
memory/2248-132-0x00007FFAB6C00000-0x00007FFAB76C1000-memory.dmp

Filesize
10.8MB

Download
memory/3236-145-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3236-143-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3236-142-0x0000000000000000-mapping.dmp

Download
memory/3884-141-0x00000000005F4000-0x00000000005F7000-memory.dmp

Filesize
12KB

Download
memory/3884-139-0x0000000000000000-mapping.dmp

Download
memory/4896-134-0x0000000000000000-mapping.dmp

Download
memory/4896-138-0x0000000000C01000-0x0000000000C04000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing