colibri | 612580febe9bad2c60ab8ad8564a38680cf415581c542e5e6109e680dc5e9d15

General

Target

mars-wallet-64-1.01.12.0-8438.exe
Size

397KB
MD5

581d545c4a3d99f4fb5b92752610e950
SHA1

66deede4f00f1a76cdcb9e52c9a42b371875be38
SHA256

612580febe9bad2c60ab8ad8564a38680cf415581c542e5e6109e680dc5e9d15
SHA512

ef036240c359453850fc5ec4bddeddff0cf7d8c5b43ded1ae620cd76de9c7fbc07533ec859236c554e97c7b2fbf286f6914630b6f36a89620139e6bee2bc5c35
SSDEEP

6144:ytN60S22Iq0NKGr8QsPgwKh10UfY2TDRK13yOz4RXvSTmE:ytN+ONKM8GwA6GJTVC3yO5N

Score

10^/10

colibri rhadamanthys bot collection discovery loader spyware stealer

Malware Config

Extracted

Family

colibri

Version

1.3.0

Botnet

bot

C2

http://176.113.115.240/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

Detect rhadamanthys stealer shellcode 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4960-139-0x00000000025E0000-0x00000000025FD000-memory.dmp	family_rhadamanthys
behavioral2/memory/4960-146-0x00000000025E0000-0x00000000025FD000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

26 4236 rundll32.exe
27 4236 rundll32.exe
Executes dropped EXE 1 IoCs

Processes:

19B2.tmp.exe

pid process

396 19B2.tmp.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4236 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
26	4236	rundll32.exe
27	4236	rundll32.exe

pid	process
396	19B2.tmp.exe

pid	process
4236	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3492 4236 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3492	4236	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

4236 rundll32.exe
4236 rundll32.exe
4236 rundll32.exe
4236 rundll32.exe

pid	process
4236	rundll32.exe
4236	rundll32.exe
4236	rundll32.exe
4236	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

mars-wallet-64-1.01.12.0-8438.exe

description	pid	process	target process
PID 4960 wrote to memory of 4236	4960	mars-wallet-64-1.01.12.0-8438.exe	rundll32.exe
PID 4960 wrote to memory of 4236	4960	mars-wallet-64-1.01.12.0-8438.exe	rundll32.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\mars-wallet-64-1.01.12.0-8438.exe
"C:\Users\Admin\AppData\Local\Temp\mars-wallet-64-1.01.12.0-8438.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Roaming\nsis_unse56f409.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8Ej|AEUAOQBzADG|AHEAdAB1GwB0|wBnAHcAcABa|i0CWUiD7CjoBP0COgCDxCjDzMz|zEyJRCQYSIn|VCQQSIlMJAj+XQFIi0QkMEiJ2wQkgQE4SG8ACEhvx0QkEC0B6w6BAV8QSIPAAY8BEIEBt0BIOZYAcyWfA4v|DCRIA8hIi8HXSItMqwFUewAD0f9Ii8qKCYgI6|3BZgVlSIsEJWD+8|AzyUiLUBhI|zvRdDZIg8Ig|0iLAkg7wnQq|2aDeEgYdRpM|4tAUGZBgzhru3QHERFLdQgREHj|EC50BUiLAOuv1UiLSP0AwWoAQP9TVVZXQVRBVe9BVkFXXQFmgTn|TVpNi|hMi|K|SIvZD4X88|BM|2NJPEGBPAlQv0UAAA+F6vPwQe+LhAmI8|CFwEi|jTwBD4TWahGDd7wJjC0BD4TH8|D|RItnIESLXxz|i3ckRItPGEz|A+FMA9lIA|H|M8lFhckPhKT+8|BNi8RBixBF|zPSSAPTigKE|8B0HUHByg0Pe77A+gABRAPQvxH|dexBgfqq|A3|fHQOg8EBSYP|wARBO8lzaev|xovBD7cMTkX|iyyLTAPrdFj7M+2qEHRRQYsU|sEA0zPJigJMi9|C6w|BycgRA8je5RABQYoA1RDtM3|AM|ZBOwy24BD+pgCDxgGD+Ahy|+7rCkiLy0H|f9VJiQT3g8XkEH|EBDtvGHKvZgH|QV9BXkFdQVzvX15dWzMXSIHs+2ABOgCL6ehm|v|||0iFwA+EmNZ1IEyNrwGLKxDIM|f|6Jt9II1fBEz|jUVGM9KLy||3VCRogCBMi+AP64RrdSBFqBAzwIt905EgSIl8JCCmIP1wgCBIi|APhEv8dSCmIFBIjVYIRH+NR0BIjYwkhRG|SIvY6Hz9fiCNq1ZI3iAQ4iHM8|Do|WfvIESLBo1XCPRBIKYgWMohiYQkgNqHEt7z8IsO2iBYiWOMJHERBzCRIOgx7yD7i5wtMkyLXTpI74P7bEiKIDBMib9kJDhMi6QaMky7iVyEAYQk3IcRhu2SjRGNR0swjCTwfvPwSYvU6On8BTC7ipx4MkiNhHgyQf+A8yGNT2xEMP0YpAKD6QF184H9vHgyIVJleHVN74uEJPQiMZQk+P41AcJIO9hyOIP|+mx2M0SNSUCe+gCUQbgAmACmIECeyiL4dBlEtjDAMUnvjVQkbJEgSYPod2zoa4IwSIvOpiD|eEiF|3QSi1XzQkyOMBsxSI1MJD9A|9dIgcR0IWEkAC0ILQE=
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:4236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4236 -s 296
3⤵
- Program crash
PID:3492

C:\Users\Admin\AppData\Local\Temp\19B2.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\19B2.tmp.exe"
1⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 4236 -ip 4236
1⤵
PID:3452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19B2.tmp.exe
Filesize
884.2MB

MD5
c137b86f5ad9d40a2968333f08955867

SHA1
d98cd7b764f3d8f94c332e63885b6d40703f4f2b

SHA256
5ca3d9ed9f316d5a208bd3a48aff70fba2d8dab6c5d5caadef0549f079442040

SHA512
e5c20f2f64a7e909eac22de9ebb2275b3c56f33e463214ee1a89a696df7d71494d30b4a1a11335393a4c6e0e56e4a5f8998d8e73195d1ea723b6d4900c3d9abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\19B2.tmp.exe
Filesize
865.9MB

MD5
9033c4e549b48c89e8e34b6efcfc0a8b

SHA1
5672b0485b6e61313a6140359c5997d378a9e139

SHA256
63534f2b2ed13d7564a680201fc8a2416b733c52c11261ed2a8103f838894182

SHA512
25268c688999038f9d9c360eb1e137dbfe8ea30398bbdf8ac20086f796eb87dd43b160da5ae34a434785356fb0d0e9714cd12e062b77bf7e23e87f1676fa4121

Download Submit
C:\Users\Admin\AppData\Roaming\nsis_unse56f409.dll
Filesize
80KB

MD5
ee5ce27b1160eba615dd590c956c5807

SHA1
add975e60e08d2669126e772932cdf12de82348e

SHA256
47b6eb2cc7af1dc14fa0aa25a23adaa9109f97b9ed9376bee1589d7a4d09e8b4

SHA512
951e2d4fbd4b95fc3d19a49fe4356c7e6c77bce5fae8e023e8e7eca185c784ee842e2387a96a747fe803a7d84b16dbbcd1512be84ed475b882447d65a051a4a5

Download Submit
C:\Users\Admin\AppData\Roaming\nsis_unse56f409.dll
Filesize
80KB

MD5
ee5ce27b1160eba615dd590c956c5807

SHA1
add975e60e08d2669126e772932cdf12de82348e

SHA256
47b6eb2cc7af1dc14fa0aa25a23adaa9109f97b9ed9376bee1589d7a4d09e8b4

SHA512
951e2d4fbd4b95fc3d19a49fe4356c7e6c77bce5fae8e023e8e7eca185c784ee842e2387a96a747fe803a7d84b16dbbcd1512be84ed475b882447d65a051a4a5

Download Submit
memory/396-158-0x0000000001070000-0x0000000001077000-memory.dmp

Filesize
28KB

Download
memory/396-157-0x0000000000C50000-0x0000000000C6D000-memory.dmp

Filesize
116KB

Download
memory/396-156-0x0000000001070000-0x0000000001077000-memory.dmp

Filesize
28KB

Download
memory/396-153-0x0000000001070000-0x0000000001077000-memory.dmp

Filesize
28KB

Download
memory/396-150-0x0000000000C50000-0x0000000000C6D000-memory.dmp

Filesize
116KB

Download
memory/4236-151-0x00007FFC47B30000-0x00007FFC47B55000-memory.dmp

Filesize
148KB

Download
memory/4236-147-0x00007FF4B0D40000-0x00007FF4B0E3A000-memory.dmp

Filesize
1000KB

Download
memory/4236-144-0x00007FF4B0D40000-0x00007FF4B0E3A000-memory.dmp

Filesize
1000KB

Download
memory/4236-143-0x000001F53B330000-0x000001F53B337000-memory.dmp

Filesize
28KB

Download
memory/4236-152-0x00007FF4B0D40000-0x00007FF4B0E3A000-memory.dmp

Filesize
1000KB

Download
memory/4236-140-0x0000000000000000-mapping.dmp

Download
memory/4960-146-0x00000000025E0000-0x00000000025FD000-memory.dmp

Filesize
116KB

Download
memory/4960-145-0x0000000000EC0000-0x0000000000F28000-memory.dmp

Filesize
416KB

Download
memory/4960-132-0x0000000000EC0000-0x0000000000F28000-memory.dmp

Filesize
416KB

Download
memory/4960-139-0x00000000025E0000-0x00000000025FD000-memory.dmp

Filesize
116KB

Download
memory/4960-138-0x0000000000748000-0x0000000000759000-memory.dmp

Filesize
68KB

Download
memory/4960-133-0x0000000000DF0000-0x0000000000E15000-memory.dmp

Filesize
148KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads