Malware sandboxing report by Hatching Triage

General

Target

1ab9115cce93709220c60217c4077c34.exe
Size

657KB
Sample

220906-kr6d6aabb2
MD5

1ab9115cce93709220c60217c4077c34
SHA1

4444d87625d9001bbbe99d975542b97884cb83a0
SHA256

5f786ef7b4a40accb4b2903acf2bdf1b249c2c4514303bb7ca3c5ac6010ac9d4
SHA512

cd46ae14d3a2c81ea4bd791a51b867293c10ee3771697f6204e816f055d366b4f9a2f9faa5285cf4dd3c5f49066aa6b75805dc61da3a561810a6ef87ac5a12e1
SSDEEP

6144:dg5nk5lJmbKTk6b3HVaMjAsbNWTIRlRDBnN9PFja0HdjfCvA+YJJAUPvQ:dg5nkxmGT3Nx0MJN9PFrHdLCY+YJg

Score

10^/10

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Extracted

Family

redline

Botnet

Lyllkal.05.09

C2

185.215.113.216:21921

Attributes

auth_value
2df530f82cb4bd0f6bef5527a1d5de70

Targets

- Target
  
  1ab9115cce93709220c60217c4077c34.exe
- Size
  
  657KB
- MD5
  
  1ab9115cce93709220c60217c4077c34
- SHA1
  
  4444d87625d9001bbbe99d975542b97884cb83a0
- SHA256
  
  5f786ef7b4a40accb4b2903acf2bdf1b249c2c4514303bb7ca3c5ac6010ac9d4
- SHA512
  
  cd46ae14d3a2c81ea4bd791a51b867293c10ee3771697f6204e816f055d366b4f9a2f9faa5285cf4dd3c5f49066aa6b75805dc61da3a561810a6ef87ac5a12e1
- SSDEEP
  
  6144:dg5nk5lJmbKTk6b3HVaMjAsbNWTIRlRDBnN9PFja0HdjfCvA+YJJAUPvQ:dg5nkxmGT3Nx0MJN9PFrHdLCY+YJg
Score

10^/10

colibri redline build1 lyllkal.05.09 infostealer loader miner persistence
- Colibri Loader
  A loader sold as MaaS first seen in August 2021.
  loader colibri
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Detectes Phoenix Miner Payload
  miner
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Colibri Loader

RedLine

Detectes Phoenix Miner Payload

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2