colibri | 6b74dc043f9a12823ed98d704e4c8543c9b5d8b9240e65e9d31d2303ab914906

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e78df69265dc57c37673bdee540ce2f.exe
Size

6.3MB
MD5

0e78df69265dc57c37673bdee540ce2f
SHA1

a1231f08b5fca28fa29b6c9621cf01c4e82f3d95
SHA256

6b74dc043f9a12823ed98d704e4c8543c9b5d8b9240e65e9d31d2303ab914906
SHA512

5fadb364171434da14d9eeb608bea23ea1278a5a871c9613fdf97ac2bcf19d701b24d5bd85cc138a9cfd0226bac7babd2c46a7dedb70326f7bb57ff88dc084b0
SSDEEP

196608:zfija2TcwZTDVO2Z6+CTV69Vd8hhWTGPr4uDt7T:GDOMCTQ4hhuE4uDxT

Score

10^/10

colibri loader vmprotect

Malware Config

Extracted

Family

colibri

http://94.103.80.169/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1704-8-0x0000000000400000-0x00000000015F1000-memory.dmp	vmprotect
behavioral1/memory/1704-38-0x0000000000400000-0x00000000015F1000-memory.dmp	vmprotect
behavioral1/memory/1704-40-0x0000000000400000-0x00000000015F1000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0e78df69265dc57c37673bdee540ce2f.exe

pid process

1704 0e78df69265dc57c37673bdee540ce2f.exe
1704 0e78df69265dc57c37673bdee540ce2f.exe

pid	process
1704	0e78df69265dc57c37673bdee540ce2f.exe
1704	0e78df69265dc57c37673bdee540ce2f.exe

C:\Users\Admin\AppData\Local\Temp\0e78df69265dc57c37673bdee540ce2f.exe
"C:\Users\Admin\AppData\Local\Temp\0e78df69265dc57c37673bdee540ce2f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-5-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1704-4-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1704-8-0x0000000000400000-0x00000000015F1000-memory.dmp

Filesize
17.9MB

Download
memory/1704-7-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1704-30-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1704-28-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1704-25-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1704-23-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1704-20-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1704-18-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1704-15-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1704-13-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1704-33-0x0000000001600000-0x0000000001607000-memory.dmp

Filesize
28KB

Download
memory/1704-37-0x0000000001600000-0x0000000001607000-memory.dmp

Filesize
28KB

Download
memory/1704-10-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1704-2-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1704-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1704-38-0x0000000000400000-0x00000000015F1000-memory.dmp

Filesize
17.9MB

Download
memory/1704-40-0x0000000000400000-0x00000000015F1000-memory.dmp

Filesize
17.9MB

Download