Analysis
-
max time kernel
1742s -
max time network
1232s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
17-02-2023 15:42
General
-
Target
f71097bbf0ae9f1bb453692e1c1c047211478b857066ef4cd3ec813b20d5fa76.exe
-
Size
194KB
-
MD5
98cf46f89ef857a797749396c9eeb62c
-
SHA1
f628c8367ff678f8907c79dfc1ce96bc4901c856
-
SHA256
f71097bbf0ae9f1bb453692e1c1c047211478b857066ef4cd3ec813b20d5fa76
-
SHA512
c9e7aeb464c8a0c268fb46b455f80afdd5b1c7e8c9e89442ffe263ca244a1b3bb8dd6a7001a47bf8678ba62076fa2069804817f1e5326b736da62cf0b4a8572a
-
SSDEEP
3072:uzsOF+4cKPo1QDLBKSWPa5jnBYP/P70zU+dTWJbIOeHE0V:uzs//duLASrBYT0zUHJcOeHE
Score
10/10
Malware Config
Extracted
Family
colibri
Version
1.4.0
Botnet
Uniques
C2
http://194.4.49.243/gate.php
rc4.plain
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f71097bbf0ae9f1bb453692e1c1c047211478b857066ef4cd3ec813b20d5fa76.exe"C:\Users\Admin\AppData\Local\Temp\f71097bbf0ae9f1bb453692e1c1c047211478b857066ef4cd3ec813b20d5fa76.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 9642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5056 -ip 50561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
-
Filesize
24KB
-
Filesize
1.4MB
-
Filesize
76KB
-
Filesize
76KB