44caliber | ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22

General

Target

ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe
Size

2.2MB
MD5

afc947b8654fcfbb2d103b0ac29f6c9e
SHA1

0f09a1b78ed6f12d767aad515516637cb0b2b0cc
SHA256

ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22
SHA512

63bb86c6766f6c34e26d68c73b8d526ca94334375c3986ab81587515c7ac07dac1e12b1c2ab3be9a48e9fbb7009e35bd18d3285974fbb47db5cf1544236e3f3c

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/839168546582954067/texAC9z_H7M0ROD6-MdvYy3D-z8YyP9fYGPhFfDYeop5TtilvsKNxw5QrTXStp-JwQ9R

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Executes dropped EXE 2 IoCs

Processes:

Insidious.exeextremeinjectorv3.7.2.exe

pid process

1828 Insidious.exe
760 extremeinjectorv3.7.2.exe

pid	process
1828	Insidious.exe
760	extremeinjectorv3.7.2.exe

Loads dropped DLL 2 IoCs

Processes:

ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe

pid	process
1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe
1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 freegeoip.app
5 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	freegeoip.app
5	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Insidious.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Insidious.exe

pid process

1828 Insidious.exe
1828 Insidious.exe
1828 Insidious.exe
1828 Insidious.exe

pid	process
1828	Insidious.exe
1828	Insidious.exe
1828	Insidious.exe
1828	Insidious.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Insidious.exeextremeinjectorv3.7.2.exe

description	pid	process
Token: SeDebugPrivilege	1828	Insidious.exe
Token: SeDebugPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: SeDebugPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	760	extremeinjectorv3.7.2.exe
Token: 33	760	extremeinjectorv3.7.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe

description	pid	process	target process
PID 1276 wrote to memory of 1828	1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	Insidious.exe
PID 1276 wrote to memory of 1828	1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	Insidious.exe
PID 1276 wrote to memory of 1828	1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	Insidious.exe
PID 1276 wrote to memory of 1828	1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	Insidious.exe
PID 1276 wrote to memory of 760	1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	extremeinjectorv3.7.2.exe
PID 1276 wrote to memory of 760	1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	extremeinjectorv3.7.2.exe
PID 1276 wrote to memory of 760	1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	extremeinjectorv3.7.2.exe
PID 1276 wrote to memory of 760	1276	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	extremeinjectorv3.7.2.exe

C:\Users\Admin\AppData\Local\Temp\ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe
"C:\Users\Admin\AppData\Local\Temp\ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\Insidious.exe
"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe
"C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5
a11acacc5f1183cf602b16479bbdb919

SHA1
62ef34a523d30a183345a1012f9abd3509218355

SHA256
ae932197671ba49b97eb4f40b1e8b316862ec493c4c6f607baa2f1afabd3d571

SHA512
247bed3a8e5e5df0f3ffa2e7406b63654da7e598e86ece4efd7813145e292f232a550eb8b389ea35d7e6ecef2e420f63dd56cbaff33745317d74e3ae51ed3e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5
a11acacc5f1183cf602b16479bbdb919

SHA1
62ef34a523d30a183345a1012f9abd3509218355

SHA256
ae932197671ba49b97eb4f40b1e8b316862ec493c4c6f607baa2f1afabd3d571

SHA512
247bed3a8e5e5df0f3ffa2e7406b63654da7e598e86ece4efd7813145e292f232a550eb8b389ea35d7e6ecef2e420f63dd56cbaff33745317d74e3ae51ed3e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe

MD5
c4394fb4daaf350cdbf5303d812e917e

SHA1
6a780c9f1c15e555b72640299b9c10e7927252f6

SHA256
0ac3387b6e0283c972722c2a6664ee23ac5ba10640d18b827e8732f5c57e7d2c

SHA512
585664a31ac2131efde439468f98c53423588348019edb3c767ffc9bb6a8a881959fd1f4a30d623a0e6a4cc02d180a146b37bef8679b55b111f46d2fb8fb82e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe

MD5
c4394fb4daaf350cdbf5303d812e917e

SHA1
6a780c9f1c15e555b72640299b9c10e7927252f6

SHA256
0ac3387b6e0283c972722c2a6664ee23ac5ba10640d18b827e8732f5c57e7d2c

SHA512
585664a31ac2131efde439468f98c53423588348019edb3c767ffc9bb6a8a881959fd1f4a30d623a0e6a4cc02d180a146b37bef8679b55b111f46d2fb8fb82e1

Download Submit
\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5
a11acacc5f1183cf602b16479bbdb919

SHA1
62ef34a523d30a183345a1012f9abd3509218355

SHA256
ae932197671ba49b97eb4f40b1e8b316862ec493c4c6f607baa2f1afabd3d571

SHA512
247bed3a8e5e5df0f3ffa2e7406b63654da7e598e86ece4efd7813145e292f232a550eb8b389ea35d7e6ecef2e420f63dd56cbaff33745317d74e3ae51ed3e33

Download Submit
\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe

MD5
c4394fb4daaf350cdbf5303d812e917e

SHA1
6a780c9f1c15e555b72640299b9c10e7927252f6

SHA256
0ac3387b6e0283c972722c2a6664ee23ac5ba10640d18b827e8732f5c57e7d2c

SHA512
585664a31ac2131efde439468f98c53423588348019edb3c767ffc9bb6a8a881959fd1f4a30d623a0e6a4cc02d180a146b37bef8679b55b111f46d2fb8fb82e1

Download Submit
memory/760-65-0x0000000000E60000-0x000000000104A000-memory.dmp

Filesize
1.9MB

Download
memory/760-71-0x000000001B607000-0x000000001B608000-memory.dmp

Filesize
4KB

Download
memory/760-63-0x000007FEF4AF3000-0x000007FEF4AF4000-memory.dmp

Filesize
4KB

Download
memory/760-75-0x000000001B60B000-0x000000001B60C000-memory.dmp

Filesize
4KB

Download
memory/760-74-0x000000001B60A000-0x000000001B60B000-memory.dmp

Filesize
4KB

Download
memory/760-73-0x000000001B609000-0x000000001B60A000-memory.dmp

Filesize
4KB

Download
memory/760-67-0x000000001B5E0000-0x000000001B5E2000-memory.dmp

Filesize
8KB

Download
memory/760-68-0x000000001B5E6000-0x000000001B605000-memory.dmp

Filesize
124KB

Download
memory/760-69-0x000000001B605000-0x000000001B606000-memory.dmp

Filesize
4KB

Download
memory/760-70-0x000000001B606000-0x000000001B607000-memory.dmp

Filesize
4KB

Download
memory/760-72-0x000000001B608000-0x000000001B609000-memory.dmp

Filesize
4KB

Download
memory/1276-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1828-62-0x000007FEF4AF3000-0x000007FEF4AF4000-memory.dmp

Filesize
4KB

Download
memory/1828-66-0x0000000000FA0000-0x0000000000FA2000-memory.dmp

Filesize
8KB

Download
memory/1828-64-0x00000000011D0000-0x000000000121A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads