Resubmissions

29-11-2022 17:31

221129-v34ptadd4y 10

06-10-2022 19:02

221006-xpybzsaegm 10

05-10-2022 21:49

221005-1pa38sfgc2 10

Analysis

  • max time kernel
    143s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2022 21:49

General

  • Target

    AppSetup/Setup.exe

  • Size

    700.0MB

  • MD5

    7c5d1c8213b4f6d0024271fef44e6cd0

  • SHA1

    207849a369dae9a6084850791e0ec53209cc928e

  • SHA256

    bde1ea677730594b57aec1799bb7a51bc1b821ea0f6fa1281127f94cc12445a5

  • SHA512

    d90f3b0054376d642e0d57f68a9cd54f8a29b893dfa4428a3a8280c0c93fc0c441b412a5367865d306a08a36720a9ed186bc290899f7c55341768188b7fa635d

  • SSDEEP

    12288:OGnwnjo3r9nWZQzjFeM6DJOjB9sTTHy832srZZUcCO5x9tWFHeQR8KeHj3Fuxkxv:OC9nYQb6VOcdFz9twRgb6kxChx47B

Score
10/10

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

test

C2

http://65.109.7.23/gate.php

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AppSetup\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\AppSetup\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1716
    • C:\Users\Admin\AppData\Local\Temp\AppSetup\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\AppSetup\Setup.exe
      2⤵
        PID:1168

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/544-54-0x0000000075A91000-0x0000000075A93000-memory.dmp
      Filesize

      8KB

    • memory/544-55-0x0000000001120000-0x00000000012EC000-memory.dmp
      Filesize

      1.8MB

    • memory/544-56-0x0000000000FA0000-0x0000000001044000-memory.dmp
      Filesize

      656KB

    • memory/544-57-0x0000000004C40000-0x0000000004CD2000-memory.dmp
      Filesize

      584KB

    • memory/1168-64-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

    • memory/1168-63-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

    • memory/1168-66-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

    • memory/1168-67-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

    • memory/1168-68-0x0000000000404F17-mapping.dmp
    • memory/1168-70-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

    • memory/1168-71-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

    • memory/1716-60-0x000000006E070000-0x000000006E61B000-memory.dmp
      Filesize

      5.7MB

    • memory/1716-61-0x000000006E070000-0x000000006E61B000-memory.dmp
      Filesize

      5.7MB

    • memory/1716-62-0x000000006E070000-0x000000006E61B000-memory.dmp
      Filesize

      5.7MB

    • memory/1716-58-0x0000000000000000-mapping.dmp