Malware sandboxing report by Hatching Triage

General

Target

2c84169bc39cd8d6dd403fcec377131c.exe
Size

4MB
Sample

221015-fhdwbsfbh3
MD5

2c84169bc39cd8d6dd403fcec377131c
SHA1

e2ea0fbe34f84d748745bb558414ebb829ed7031
SHA256

8cf64f5d90065639f894f78a334386f75ffe99f8c41b05b2f03cf0a5438b9276
SHA512

8a22ed9e6c98331663c291b9bb7b824a5bbb2a7f37c2ccc5e2b4afeafda9a8e5c1f44186b879bda7d850df975f6b1aba1c547ebe651decfe4fb8897de906ede5
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Targets

- Target
  
  2c84169bc39cd8d6dd403fcec377131c.exe
- Size
  
  4MB
- MD5
  
  2c84169bc39cd8d6dd403fcec377131c
- SHA1
  
  e2ea0fbe34f84d748745bb558414ebb829ed7031
- SHA256
  
  8cf64f5d90065639f894f78a334386f75ffe99f8c41b05b2f03cf0a5438b9276
- SHA512
  
  8a22ed9e6c98331663c291b9bb7b824a5bbb2a7f37c2ccc5e2b4afeafda9a8e5c1f44186b879bda7d850df975f6b1aba1c547ebe651decfe4fb8897de906ede5
- SSDEEP
  
  49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Score

10^/10

dcrat evasion infostealer rat trojan colibri build1 loader
- Colibri Loader
  A loader sold as MaaS first seen in August 2021.
  loader colibri
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

Bypass User Account Control

Tasks

Sharing

General

Malware Config

Extracted

Targets

Colibri Loader

DcRat

Process spawned unexpected child process

UAC bypass

DCRat payload

Executes dropped EXE

Checks computer location settings

Checks whether UAC is enabled

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2