Analysis
-
max time kernel
4294178s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
01-03-2022 18:11
General
-
Target
60987a7f9108d404f6e627e7619141b77542cad0b224935c08161ac3f51c2b29.exe
-
Size
653KB
-
MD5
db2e487937eaed60e7169e2b48e68d16
-
SHA1
2210476000b468726672586519dab9018285ac37
-
SHA256
60987a7f9108d404f6e627e7619141b77542cad0b224935c08161ac3f51c2b29
-
SHA512
e3a7f8d8e3657a327227507e6f579a67eae3847b5bb20eeac13414738dd431709f5bad1d27cc8610baae45f3bd6ec7266192af7583ce9ff6f00366fca629f464
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/855741652172668938/zP2fr-M7cRreY83gv1pyNcOoaU2XiDMn2LeRM_y5_L1sMkvKAymQPW05meJF52Pblm-2
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60987a7f9108d404f6e627e7619141b77542cad0b224935c08161ac3f51c2b29.exe"C:\Users\Admin\AppData\Local\Temp\60987a7f9108d404f6e627e7619141b77542cad0b224935c08161ac3f51c2b29.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
-
Filesize
8KB
-
Filesize
4KB