colibri | 6e68bcd52321a8d0443d5c5d6131410c07ef44a8cb3388550f78a3dea303e840

General

Target

invoice.xll
Size

597KB
MD5

d9efc163b90630251fb7ff7c822e8f0f
SHA1

9e09cce65d2371bc95e213a9007337933b11c3f9
SHA256

6e68bcd52321a8d0443d5c5d6131410c07ef44a8cb3388550f78a3dea303e840
SHA512

33bef8014ce017591e79e7642ab3d0c48306cb1b98b254c9a0aa4aa07f1ddce696ddfb4e89e0d230d7f2ae535db58a133797280bfd26d41c69588e396a3a5031
SSDEEP

12288:xn/zDvGHAykHSzLW/4+8bzbBSreMdbYkBkgFK/UqW:lzbGHAzHAjX1IqcL

Score

10^/10

colibri exploits loader

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

colibri

Version

1.4.0

Botnet

exploits

C2

http://194.4.49.243/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1836	1772	cmd.exe	82

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3628	newllootexpreol.exe

Loads dropped DLL 2 IoCs

pid	Process
1772	EXCEL.EXE
1772	EXCEL.EXE

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3628 set thread context of 1312	3628	newllootexpreol.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1772	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2336	EXCEL.EXE
2336	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	EXCEL.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
2336	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE
1772	EXCEL.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3628	1772	EXCEL.EXE	85
PID 1772 wrote to memory of 3628	1772	EXCEL.EXE	85
PID 1772 wrote to memory of 3628	1772	EXCEL.EXE	85
PID 1772 wrote to memory of 1836	1772	EXCEL.EXE	86
PID 1772 wrote to memory of 1836	1772	EXCEL.EXE	86
PID 1836 wrote to memory of 2336	1836	cmd.exe	88
PID 1836 wrote to memory of 2336	1836	cmd.exe	88
PID 1836 wrote to memory of 2336	1836	cmd.exe	88
PID 3628 wrote to memory of 1312	3628	newllootexpreol.exe	90
PID 3628 wrote to memory of 1312	3628	newllootexpreol.exe	90
PID 3628 wrote to memory of 1312	3628	newllootexpreol.exe	90
PID 3628 wrote to memory of 1312	3628	newllootexpreol.exe	90
PID 3628 wrote to memory of 1312	3628	newllootexpreol.exe	90
PID 3628 wrote to memory of 1312	3628	newllootexpreol.exe	90
PID 3628 wrote to memory of 1312	3628	newllootexpreol.exe	90

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\invoice.xll"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\dcr\newllootexpreol.exe
  "C:\Users\Admin\AppData\Local\Temp\dcr\newllootexpreol.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:1312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C start %temp%/Excel.xlsx
  2⤵
  - Process spawned unexpected child process
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Excel.xlsx"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

Web Service

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
325KB

MD5
0e3e0fa602a0e208dce34c50704e2b56

SHA1
e1ed5eab2d06872bb50a607b7966c01b81ecd2f5

SHA256
28d53bd99ec106eef21de121509cdee6e575cde44613aa59aa3a70e6449678f5

SHA512
1ca09a46e162064b05ce301df35ffad39afa13ae22c404248593bd6ce700e94019b4ac66fb129af1d6ba89d0c9c5369e32d498e80bdfccde860a9b94ec96112f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Filesize
4KB

MD5
f138a66469c10d5761c6cbb36f2163c3

SHA1
eea136206474280549586923b7a4a3c6d5db1e25

SHA256
c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6

SHA512
9d25f943b6137dd2981ee75d57baf3a9e0ee27eea2df19591d580f02ec8520d837b8e419a8b1eb7197614a3c6d8793c56ebc848c38295ada23c31273daa302d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal

Filesize
48KB

MD5
8fcad4842240c0f4b6b25eb228ef97bb

SHA1
761ca74981d21dc3a8f389824f01fee61cf3dbb9

SHA256
3d2e697f6df883a357fe776fa57993be657f3ec9ae74a9f1c0782eb6a43da90f

SHA512
952b144f6a6e69c4b1fa28e9c6e68a3cc0f52fa0cfd74eedf7e75441dae3a4b48cbfcef87ca2f83bf8c954152620001fb4cd74a62e2095f0a6f00e0617ffcbdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Excel.xlsx

Filesize
28KB

MD5
227309c38b94761602a95dd17430ee08

SHA1
d079c80ce95b1c67b39b87f781ef920dfd30096e

SHA256
defb3d374a7070805dadea394b81be97dce99d3417e9ceeb777d34a33a5ec86e

SHA512
236195c3c434124deedc059f0e3797df24d1e6cdfc5549e58e79522045a94616c800f928f10f902cee1c38496ec9c852adcb43335f49c562a4668e53c8939066

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcr\newllootexpreol.exe

Filesize
350.5MB

MD5
b6263868c06f273e9163ea1012346743

SHA1
7b51675283bc2d15cadb4134c7001daacca6f622

SHA256
ff9a3d98641589762961d53464b3a735fc103d61e8f99af6fb049ab63f897f6a

SHA512
1a1cdfb8f3f00a81db4fded506533d4e20f56b637edbf57b581e31ad28f42d7739b1ba9f392091b2979c25c2d98d8eed7d755b4de5ed1f633c8520dbf65c61bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcr\newllootexpreol.exe

Filesize
350.5MB

MD5
b6263868c06f273e9163ea1012346743

SHA1
7b51675283bc2d15cadb4134c7001daacca6f622

SHA256
ff9a3d98641589762961d53464b3a735fc103d61e8f99af6fb049ab63f897f6a

SHA512
1a1cdfb8f3f00a81db4fded506533d4e20f56b637edbf57b581e31ad28f42d7739b1ba9f392091b2979c25c2d98d8eed7d755b4de5ed1f633c8520dbf65c61bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\invoice.xll

Filesize
597KB

MD5
d9efc163b90630251fb7ff7c822e8f0f

SHA1
9e09cce65d2371bc95e213a9007337933b11c3f9

SHA256
6e68bcd52321a8d0443d5c5d6131410c07ef44a8cb3388550f78a3dea303e840

SHA512
33bef8014ce017591e79e7642ab3d0c48306cb1b98b254c9a0aa4aa07f1ddce696ddfb4e89e0d230d7f2ae535db58a133797280bfd26d41c69588e396a3a5031

Download Submit
C:\Users\Admin\AppData\Local\Temp\invoice.xll

Filesize
597KB

MD5
d9efc163b90630251fb7ff7c822e8f0f

SHA1
9e09cce65d2371bc95e213a9007337933b11c3f9

SHA256
6e68bcd52321a8d0443d5c5d6131410c07ef44a8cb3388550f78a3dea303e840

SHA512
33bef8014ce017591e79e7642ab3d0c48306cb1b98b254c9a0aa4aa07f1ddce696ddfb4e89e0d230d7f2ae535db58a133797280bfd26d41c69588e396a3a5031

Download Submit
memory/1312-177-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1312-169-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1312-164-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1772-138-0x00007FFBDB3A0000-0x00007FFBDB3B0000-memory.dmp

Filesize
64KB

Download
memory/1772-134-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/1772-132-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/1772-140-0x000001C11EB60000-0x000001C11EC0F000-memory.dmp

Filesize
700KB

Download
memory/1772-146-0x000001C136EE0000-0x000001C136EF2000-memory.dmp

Filesize
72KB

Download
memory/1772-137-0x00007FFBDB3A0000-0x00007FFBDB3B0000-memory.dmp

Filesize
64KB

Download
memory/1772-136-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/1772-133-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/1772-143-0x00007FFBF3920000-0x00007FFBF43E1000-memory.dmp

Filesize
10.8MB

Download
memory/1772-135-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/1772-144-0x000001C11EC5C000-0x000001C11EC5F000-memory.dmp

Filesize
12KB

Download
memory/1772-165-0x000001C11EC5C000-0x000001C11EC5F000-memory.dmp

Filesize
12KB

Download
memory/1772-145-0x000001C11ECF0000-0x000001C11ECFA000-memory.dmp

Filesize
40KB

Download
memory/1772-163-0x00007FFBF3920000-0x00007FFBF43E1000-memory.dmp

Filesize
10.8MB

Download
memory/2336-173-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/2336-174-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/2336-175-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/2336-176-0x00007FFBDD8B0000-0x00007FFBDD8C0000-memory.dmp

Filesize
64KB

Download
memory/3628-161-0x0000000004F90000-0x0000000004FF6000-memory.dmp

Filesize
408KB

Download
memory/3628-160-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/3628-155-0x0000000005330000-0x00000000058D4000-memory.dmp

Filesize
5.6MB

Download
memory/3628-152-0x0000000000460000-0x00000000004DC000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads