Malware sandboxing report by Hatching Triage

General

Target

42d2f3d3157c790b31a09a0ca173feae.exe
Size

4MB
Sample

221015-p3gx6affbr
MD5

42d2f3d3157c790b31a09a0ca173feae
SHA1

a7694973c9dff0f3d624a9c00d2f36dcf9455b10
SHA256

8fb6ada4913777c02d68c945590916490da636dd5970542be792737e32a2a64a
SHA512

b7fea8abe3de9864acaaafae14932695db452607e7fd76542fb1093bfbbf897f86693d7ea207706b952081ff92d05b177d0d224ce4cdf33302b8424dfaa93d90
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Targets

- Target
  
  42d2f3d3157c790b31a09a0ca173feae.exe
- Size
  
  4MB
- MD5
  
  42d2f3d3157c790b31a09a0ca173feae
- SHA1
  
  a7694973c9dff0f3d624a9c00d2f36dcf9455b10
- SHA256
  
  8fb6ada4913777c02d68c945590916490da636dd5970542be792737e32a2a64a
- SHA512
  
  b7fea8abe3de9864acaaafae14932695db452607e7fd76542fb1093bfbbf897f86693d7ea207706b952081ff92d05b177d0d224ce4cdf33302b8424dfaa93d90
- SSDEEP
  
  49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Score

10^/10

dcrat evasion infostealer rat trojan colibri build1 loader spyware stealer
- Colibri Loader
  A loader sold as MaaS first seen in August 2021.
  loader colibri
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Data from Local System

Command and Control

Credential Access

Credentials in Files

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

Bypass User Account Control

Tasks

Sharing

General

Malware Config

Extracted

Targets

Colibri Loader

DcRat

Process spawned unexpected child process

UAC bypass

DCRat payload

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks whether UAC is enabled

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2