Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2023 11:24
Static task
static1
Behavioral task
behavioral1
Sample
XboxUpdate.exe
Resource
win7-20230220-en
General
-
Target
XboxUpdate.exe
-
Size
2.4MB
-
MD5
9539d670b998aa46651b51d69123b909
-
SHA1
77c4912a7b67260c486fda2f93a3b98ecb5e7d65
-
SHA256
52712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669
-
SHA512
9352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa
-
SSDEEP
12288:j0t4Sb/JDZcAVeF8EGoBzFXe2iFi3R6I9VTnHdyFe2OAdnRC9oC5pZxsumiT:jG4GVZcXfiw8Wn9yFPxdnRC9oCr3
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XboxUpdate.exeXboxUpdate.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation XboxUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation XboxUpdate.exe -
Executes dropped EXE 6 IoCs
Processes:
tmp91E4.tmp.exetmp91E4.tmp.exeXboxUpdate.exetmpE4C7.tmp.exetmpE4C7.tmp.exetmpE4C7.tmp.exepid process 4088 tmp91E4.tmp.exe 4524 tmp91E4.tmp.exe 2964 XboxUpdate.exe 3988 tmpE4C7.tmp.exe 1048 tmpE4C7.tmp.exe 180 tmpE4C7.tmp.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
tmp91E4.tmp.exetmpE4C7.tmp.exedescription pid process target process PID 4088 set thread context of 4524 4088 tmp91E4.tmp.exe tmp91E4.tmp.exe PID 1048 set thread context of 180 1048 tmpE4C7.tmp.exe tmpE4C7.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
XboxUpdate.exepid process 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe 4352 XboxUpdate.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
XboxUpdate.exepowershell.exeXboxUpdate.exedescription pid process Token: SeDebugPrivilege 4352 XboxUpdate.exe Token: SeDebugPrivilege 3584 powershell.exe Token: SeDebugPrivilege 2964 XboxUpdate.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
XboxUpdate.exetmp91E4.tmp.exeXboxUpdate.exetmpE4C7.tmp.exetmpE4C7.tmp.exedescription pid process target process PID 4352 wrote to memory of 4088 4352 XboxUpdate.exe tmp91E4.tmp.exe PID 4352 wrote to memory of 4088 4352 XboxUpdate.exe tmp91E4.tmp.exe PID 4352 wrote to memory of 4088 4352 XboxUpdate.exe tmp91E4.tmp.exe PID 4088 wrote to memory of 4524 4088 tmp91E4.tmp.exe tmp91E4.tmp.exe PID 4088 wrote to memory of 4524 4088 tmp91E4.tmp.exe tmp91E4.tmp.exe PID 4088 wrote to memory of 4524 4088 tmp91E4.tmp.exe tmp91E4.tmp.exe PID 4088 wrote to memory of 4524 4088 tmp91E4.tmp.exe tmp91E4.tmp.exe PID 4088 wrote to memory of 4524 4088 tmp91E4.tmp.exe tmp91E4.tmp.exe PID 4088 wrote to memory of 4524 4088 tmp91E4.tmp.exe tmp91E4.tmp.exe PID 4088 wrote to memory of 4524 4088 tmp91E4.tmp.exe tmp91E4.tmp.exe PID 4352 wrote to memory of 3584 4352 XboxUpdate.exe powershell.exe PID 4352 wrote to memory of 3584 4352 XboxUpdate.exe powershell.exe PID 2964 wrote to memory of 3988 2964 XboxUpdate.exe tmpE4C7.tmp.exe PID 2964 wrote to memory of 3988 2964 XboxUpdate.exe tmpE4C7.tmp.exe PID 2964 wrote to memory of 3988 2964 XboxUpdate.exe tmpE4C7.tmp.exe PID 3988 wrote to memory of 1048 3988 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 3988 wrote to memory of 1048 3988 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 3988 wrote to memory of 1048 3988 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 1048 wrote to memory of 180 1048 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 1048 wrote to memory of 180 1048 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 1048 wrote to memory of 180 1048 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 1048 wrote to memory of 180 1048 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 1048 wrote to memory of 180 1048 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 1048 wrote to memory of 180 1048 tmpE4C7.tmp.exe tmpE4C7.tmp.exe PID 1048 wrote to memory of 180 1048 tmpE4C7.tmp.exe tmpE4C7.tmp.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XboxUpdate.exe"C:\Users\Admin\AppData\Local\Temp\XboxUpdate.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp91E4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp91E4.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp91E4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp91E4.tmp.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\XboxUpdate.exeC:\Users\Admin\AppData\Roaming\XboxUpdate.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cuuiiqgc.2rx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp91E4.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp91E4.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp91E4.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmp91E4.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Local\Temp\tmpE4C7.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
C:\Users\Admin\AppData\Roaming\XboxUpdate.exeFilesize
2.4MB
MD59539d670b998aa46651b51d69123b909
SHA177c4912a7b67260c486fda2f93a3b98ecb5e7d65
SHA25652712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669
SHA5129352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa
-
C:\Users\Admin\AppData\Roaming\XboxUpdate.exeFilesize
2.4MB
MD59539d670b998aa46651b51d69123b909
SHA177c4912a7b67260c486fda2f93a3b98ecb5e7d65
SHA25652712a99b6b73458711a3af355c6b63a45457a9590964c835e08f6da84a09669
SHA5129352b2c5c3b7f19a9c80bd574bd376d1db67cfcb8284abbab81b43efa881591a59cb25de0ff843d54bb958a05dccd783d342316a504bf8528f5e7b2cc02ee1aa
-
memory/2964-1349-0x00000000028D0000-0x00000000028E0000-memory.dmpFilesize
64KB
-
memory/2964-2424-0x00000000028D0000-0x00000000028E0000-memory.dmpFilesize
64KB
-
memory/3584-1281-0x00000258EA0A0000-0x00000258EA0B0000-memory.dmpFilesize
64KB
-
memory/3584-1279-0x00000258EA0A0000-0x00000258EA0B0000-memory.dmpFilesize
64KB
-
memory/3584-1274-0x00000258EA050000-0x00000258EA072000-memory.dmpFilesize
136KB
-
memory/3584-1282-0x00000258EA0A0000-0x00000258EA0B0000-memory.dmpFilesize
64KB
-
memory/4352-182-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-162-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-168-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-170-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-172-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-174-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-176-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-178-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-180-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-133-0x0000000000B10000-0x0000000000D80000-memory.dmpFilesize
2.4MB
-
memory/4352-184-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-186-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-188-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-190-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-192-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-195-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-197-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-199-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-164-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-166-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-160-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-158-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-134-0x00000000014D0000-0x00000000014E0000-memory.dmpFilesize
64KB
-
memory/4352-1268-0x00000000014D0000-0x00000000014E0000-memory.dmpFilesize
64KB
-
memory/4352-156-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-154-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-152-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-150-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-148-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-146-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-144-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-142-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-140-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-138-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-136-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4352-135-0x000000001BCC0000-0x000000001BD62000-memory.dmpFilesize
648KB
-
memory/4524-497-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB