General
-
Target
2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe
-
Size
4.9MB
-
Sample
241205-v2ts8a1jaj
-
MD5
8be8a5d36bb940a1d6b70d3277ca420a
-
SHA1
50e6780f3711ab913e56e1f159d34ef4e29e9bea
-
SHA256
2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f
-
SHA512
f02563d80839cf345cc8d360419c38f231f9055408afed0fe8da8f25b0b362fcb5640e5d0b7ee580d7c6df095c90923b74f45a532916245ce0314337f2a052b5
-
SSDEEP
49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8X:v
Static task
static1
Behavioral task
behavioral1
Sample
2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe
Resource
win7-20240708-en
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Targets
-
-
Target
2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe
-
Size
4.9MB
-
MD5
8be8a5d36bb940a1d6b70d3277ca420a
-
SHA1
50e6780f3711ab913e56e1f159d34ef4e29e9bea
-
SHA256
2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f
-
SHA512
f02563d80839cf345cc8d360419c38f231f9055408afed0fe8da8f25b0b362fcb5640e5d0b7ee580d7c6df095c90923b74f45a532916245ce0314337f2a052b5
-
SSDEEP
49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8X:v
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2