General

  • Target

    148D9ED52B15AA29E6A5D501CD575BD119039FFC2051B.exe

  • Size

    1MB

  • Sample

    221019-s3thqsebb4

  • MD5

    443880cbb37d23e8c3846e0b3c7f7358

  • SHA1

    0824425675beced43463ee3943f745f4dd4f9110

  • SHA256

    148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1

  • SHA512

    5ca14e9a0ab251e30deb47383f20f8d288e34086bbf2e75438e6907e31e9128a49373dba29cedaef95e5cb228efdd69b39a4e14ef761b7d95dabd3b33ad0c766

  • SSDEEP

    24576:CNhI4oUnscbH/4IhUaTkO4yMFBSPQh6PTntnjjgRGVDkkahscbqk9zDRXq6LYsU/:MXHw+UBT6Ld/9Ss8DxxL7dEMZ

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Targets

    • Target

      148D9ED52B15AA29E6A5D501CD575BD119039FFC2051B.exe

    • Size

      1MB

    • MD5

      443880cbb37d23e8c3846e0b3c7f7358

    • SHA1

      0824425675beced43463ee3943f745f4dd4f9110

    • SHA256

      148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1

    • SHA512

      5ca14e9a0ab251e30deb47383f20f8d288e34086bbf2e75438e6907e31e9128a49373dba29cedaef95e5cb228efdd69b39a4e14ef761b7d95dabd3b33ad0c766

    • SSDEEP

      24576:CNhI4oUnscbH/4IhUaTkO4yMFBSPQh6PTntnjjgRGVDkkahscbqk9zDRXq6LYsU/:MXHw+UBT6Ld/9Ss8DxxL7dEMZ

    • Colibri Loader

      A loader sold as MaaS first seen in August 2021.

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks