Analysis
-
max time kernel
115s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 14:07
Static task
static1
Behavioral task
behavioral1
Sample
ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe
Resource
win7-20220812-en
General
-
Target
ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe
-
Size
492KB
-
MD5
81d3017db518b0b252fbc291a5c7d992
-
SHA1
e05a2679511cc7d307c79b3170f9e8baaf87babc
-
SHA256
ed28743bfc1a8f95a95e5c6fee5597d6961e497413d8e9b3544588ae7484f3f4
-
SHA512
e9380fad8c17727c692c4c661e473be836010d4d456af7a8bb2999153a3c26735e080fa6274a62d2634b0510ecfe4eb4e656234eca2f4a9a03575d959a9cc6bb
-
SSDEEP
12288:gOfPr+8CHzhgAOt0AcfAWV5CRbdjNA98wl:hfz+NThghUAWVMRRjNJ
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
tmp6B7.tmp.exetmp6B7.tmp.exeloader.exepid process 1988 tmp6B7.tmp.exe 3844 tmp6B7.tmp.exe 4808 loader.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\loader.exe upx C:\Users\Admin\AppData\Roaming\loader.exe upx behavioral2/memory/4808-155-0x0000000000780000-0x0000000001A26000-memory.dmp upx behavioral2/memory/4808-157-0x0000000000780000-0x0000000001A26000-memory.dmp upx behavioral2/memory/4808-162-0x0000000000780000-0x0000000001A26000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp6B7.tmp.exedescription pid process target process PID 1988 set thread context of 3844 1988 tmp6B7.tmp.exe tmp6B7.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exepowershell.exepid process 2208 ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe 4524 powershell.exe 4524 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exepowershell.exedescription pid process Token: SeDebugPrivilege 2208 ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe Token: SeDebugPrivilege 4524 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exetmp6B7.tmp.exeloader.exedescription pid process target process PID 2208 wrote to memory of 1988 2208 ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe tmp6B7.tmp.exe PID 2208 wrote to memory of 1988 2208 ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe tmp6B7.tmp.exe PID 2208 wrote to memory of 1988 2208 ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe tmp6B7.tmp.exe PID 1988 wrote to memory of 3844 1988 tmp6B7.tmp.exe tmp6B7.tmp.exe PID 1988 wrote to memory of 3844 1988 tmp6B7.tmp.exe tmp6B7.tmp.exe PID 1988 wrote to memory of 3844 1988 tmp6B7.tmp.exe tmp6B7.tmp.exe PID 1988 wrote to memory of 3844 1988 tmp6B7.tmp.exe tmp6B7.tmp.exe PID 1988 wrote to memory of 3844 1988 tmp6B7.tmp.exe tmp6B7.tmp.exe PID 1988 wrote to memory of 3844 1988 tmp6B7.tmp.exe tmp6B7.tmp.exe PID 1988 wrote to memory of 3844 1988 tmp6B7.tmp.exe tmp6B7.tmp.exe PID 2208 wrote to memory of 4808 2208 ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe loader.exe PID 2208 wrote to memory of 4808 2208 ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe loader.exe PID 4808 wrote to memory of 4524 4808 loader.exe powershell.exe PID 4808 wrote to memory of 4524 4808 loader.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe"C:\Users\Admin\AppData\Local\Temp\ED28743BFC1A8F95A95E5C6FEE5597D6961E497413D8E.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6B7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6B7.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6B7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6B7.tmp.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\loader.exe"C:\Users\Admin\AppData\Roaming\loader.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "Get-WmiObject Win32_PortConnector"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6B7.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp6B7.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp6B7.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Roaming\loader.exeFilesize
5.1MB
MD5f505b027e7d5da22ee6f4b9d3fb35978
SHA157931a188c5bcdfaeab508598574a3e2113b6495
SHA2568860992a5b56bbeb6e67d208b1e3ba37b7795bcaee9b21f12bbc8c09862585e5
SHA5127cd0b37bca9a19e9f5834c8dfe8d11eedbde370f1ea430632e6c7006deb7ab9352fb4616bc7293a156cfc5bd0b49c3d9e643ab3780b897bcf3fe8a09468c5c45
-
C:\Users\Admin\AppData\Roaming\loader.exeFilesize
5.1MB
MD5f505b027e7d5da22ee6f4b9d3fb35978
SHA157931a188c5bcdfaeab508598574a3e2113b6495
SHA2568860992a5b56bbeb6e67d208b1e3ba37b7795bcaee9b21f12bbc8c09862585e5
SHA5127cd0b37bca9a19e9f5834c8dfe8d11eedbde370f1ea430632e6c7006deb7ab9352fb4616bc7293a156cfc5bd0b49c3d9e643ab3780b897bcf3fe8a09468c5c45
-
memory/1988-137-0x0000000000B80000-0x0000000000B83000-memory.dmpFilesize
12KB
-
memory/1988-134-0x0000000000000000-mapping.dmp
-
memory/2208-143-0x000000001D610000-0x000000001D622000-memory.dmpFilesize
72KB
-
memory/2208-151-0x000000001E5E0000-0x000000001E630000-memory.dmpFilesize
320KB
-
memory/2208-141-0x000000001DFA0000-0x000000001E0AA000-memory.dmpFilesize
1.0MB
-
memory/2208-132-0x0000000000F50000-0x0000000000FD2000-memory.dmpFilesize
520KB
-
memory/2208-156-0x00007FFBA9210000-0x00007FFBA9CD1000-memory.dmpFilesize
10.8MB
-
memory/2208-144-0x000000001D670000-0x000000001D6AC000-memory.dmpFilesize
240KB
-
memory/2208-145-0x00007FFBA9210000-0x00007FFBA9CD1000-memory.dmpFilesize
10.8MB
-
memory/2208-133-0x00007FFBA9210000-0x00007FFBA9CD1000-memory.dmpFilesize
10.8MB
-
memory/2208-147-0x000000001E230000-0x000000001E2A6000-memory.dmpFilesize
472KB
-
memory/2208-148-0x000000001D630000-0x000000001D64E000-memory.dmpFilesize
120KB
-
memory/2208-149-0x000000001E7B0000-0x000000001E972000-memory.dmpFilesize
1.8MB
-
memory/2208-150-0x000000001EEB0000-0x000000001F3D8000-memory.dmpFilesize
5.2MB
-
memory/3844-139-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3844-146-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3844-142-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3844-138-0x0000000000000000-mapping.dmp
-
memory/4524-158-0x0000000000000000-mapping.dmp
-
memory/4524-159-0x0000023B57490000-0x0000023B574B2000-memory.dmpFilesize
136KB
-
memory/4524-160-0x00007FFBA9240000-0x00007FFBA9D01000-memory.dmpFilesize
10.8MB
-
memory/4524-161-0x00007FFBA9240000-0x00007FFBA9D01000-memory.dmpFilesize
10.8MB
-
memory/4808-152-0x0000000000000000-mapping.dmp
-
memory/4808-155-0x0000000000780000-0x0000000001A26000-memory.dmpFilesize
18.6MB
-
memory/4808-157-0x0000000000780000-0x0000000001A26000-memory.dmpFilesize
18.6MB
-
memory/4808-162-0x0000000000780000-0x0000000001A26000-memory.dmpFilesize
18.6MB