General

  • Target

    42d2f3d3157c790b31a09a0ca173feae.exe

  • Size

    4.9MB

  • Sample

    221015-p3gx6affbr

  • MD5

    42d2f3d3157c790b31a09a0ca173feae

  • SHA1

    a7694973c9dff0f3d624a9c00d2f36dcf9455b10

  • SHA256

    8fb6ada4913777c02d68c945590916490da636dd5970542be792737e32a2a64a

  • SHA512

    b7fea8abe3de9864acaaafae14932695db452607e7fd76542fb1093bfbbf897f86693d7ea207706b952081ff92d05b177d0d224ce4cdf33302b8424dfaa93d90

  • SSDEEP

    49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Targets

    • Target

      42d2f3d3157c790b31a09a0ca173feae.exe

    • Size

      4.9MB

    • MD5

      42d2f3d3157c790b31a09a0ca173feae

    • SHA1

      a7694973c9dff0f3d624a9c00d2f36dcf9455b10

    • SHA256

      8fb6ada4913777c02d68c945590916490da636dd5970542be792737e32a2a64a

    • SHA512

      b7fea8abe3de9864acaaafae14932695db452607e7fd76542fb1093bfbbf897f86693d7ea207706b952081ff92d05b177d0d224ce4cdf33302b8424dfaa93d90

    • SSDEEP

      49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

    • Colibri Loader

      A loader sold as MaaS first seen in August 2021.

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks