colibri | 0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7

General

Target

0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe
Size

2.1MB
MD5

f0c0bd9f2464a22b26cd1e59f061c301
SHA1

9f4af038778fd91eb409c774c88325d23cf48c26
SHA256

0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7
SHA512

090872ec9db441be82172fe4b093ec0f6b55183341fea747e8ea66591aa81422e69d2b5d227369b22f7088a7d9d8eeb0fdd0d4818072372032425d2c321e0748
SSDEEP

24576:lJ/Q7WLg9oER9uXtIkOrGoJHcuA2yZdwMrl9Je:d

Score

10^/10

colibri build1 loader

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Executes dropped EXE 2 IoCs

Processes:

tmp2F9B.tmp.exetmp2F9B.tmp.exe

pid process

2080 tmp2F9B.tmp.exe
4768 tmp2F9B.tmp.exe

pid	process
2080	tmp2F9B.tmp.exe
4768	tmp2F9B.tmp.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp2F9B.tmp.exe

description pid process target process

PID 2080 set thread context of 4768 2080 tmp2F9B.tmp.exe tmp2F9B.tmp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe

description pid process

Token: SeDebugPrivilege 3888 0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe

description	pid	process	target process
PID 2080 set thread context of 4768	2080	tmp2F9B.tmp.exe	tmp2F9B.tmp.exe

description	pid	process
Token: SeDebugPrivilege	3888	0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exetmp2F9B.tmp.exe

description	pid	process	target process
PID 3888 wrote to memory of 2080	3888	0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe	tmp2F9B.tmp.exe
PID 3888 wrote to memory of 2080	3888	0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe	tmp2F9B.tmp.exe
PID 3888 wrote to memory of 2080	3888	0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe	tmp2F9B.tmp.exe
PID 2080 wrote to memory of 4768	2080	tmp2F9B.tmp.exe	tmp2F9B.tmp.exe
PID 2080 wrote to memory of 4768	2080	tmp2F9B.tmp.exe	tmp2F9B.tmp.exe
PID 2080 wrote to memory of 4768	2080	tmp2F9B.tmp.exe	tmp2F9B.tmp.exe
PID 2080 wrote to memory of 4768	2080	tmp2F9B.tmp.exe	tmp2F9B.tmp.exe
PID 2080 wrote to memory of 4768	2080	tmp2F9B.tmp.exe	tmp2F9B.tmp.exe
PID 2080 wrote to memory of 4768	2080	tmp2F9B.tmp.exe	tmp2F9B.tmp.exe
PID 2080 wrote to memory of 4768	2080	tmp2F9B.tmp.exe	tmp2F9B.tmp.exe

C:\Users\Admin\AppData\Local\Temp\0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe
"C:\Users\Admin\AppData\Local\Temp\0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888

C:\Users\Admin\AppData\Local\Temp\tmp2F9B.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp2F9B.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080

C:\Users\Admin\AppData\Local\Temp\tmp2F9B.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp2F9B.tmp.exe"
3⤵
- Executes dropped EXE
PID:4768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2F9B.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2F9B.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2F9B.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/2080-135-0x0000000000000000-mapping.dmp

Download
memory/2080-138-0x00000000013DB000-0x00000000013E1000-memory.dmp

Filesize
24KB

Download
memory/3888-132-0x0000000000110000-0x000000000033A000-memory.dmp

Filesize
2.2MB

Download
memory/3888-133-0x00007FFC9F6D0000-0x00007FFCA0191000-memory.dmp

Filesize
10.8MB

Download
memory/3888-134-0x00007FFC9F6D0000-0x00007FFCA0191000-memory.dmp

Filesize
10.8MB

Download
memory/4768-139-0x0000000000000000-mapping.dmp

Download
memory/4768-140-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4768-142-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing