44caliber | ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22

General

Target

ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe
Size

2.2MB
MD5

afc947b8654fcfbb2d103b0ac29f6c9e
SHA1

0f09a1b78ed6f12d767aad515516637cb0b2b0cc
SHA256

ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22
SHA512

63bb86c6766f6c34e26d68c73b8d526ca94334375c3986ab81587515c7ac07dac1e12b1c2ab3be9a48e9fbb7009e35bd18d3285974fbb47db5cf1544236e3f3c

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/839168546582954067/texAC9z_H7M0ROD6-MdvYy3D-z8YyP9fYGPhFfDYeop5TtilvsKNxw5QrTXStp-JwQ9R

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Executes dropped EXE 2 IoCs

Processes:

Insidious.exeextremeinjectorv3.7.2.exe

pid process

1324 Insidious.exe
1544 extremeinjectorv3.7.2.exe

pid	process
1324	Insidious.exe
1544	extremeinjectorv3.7.2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
7	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Insidious.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Insidious.exe

pid process

1324 Insidious.exe
1324 Insidious.exe
1324 Insidious.exe
1324 Insidious.exe

pid	process
1324	Insidious.exe
1324	Insidious.exe
1324	Insidious.exe
1324	Insidious.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Insidious.exeextremeinjectorv3.7.2.exe

description	pid	process
Token: SeDebugPrivilege	1324	Insidious.exe
Token: SeDebugPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: SeDebugPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe
Token: SeIncBasePriorityPrivilege	1544	extremeinjectorv3.7.2.exe
Token: 33	1544	extremeinjectorv3.7.2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe

description	pid	process	target process
PID 2388 wrote to memory of 1324	2388	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	Insidious.exe
PID 2388 wrote to memory of 1324	2388	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	Insidious.exe
PID 2388 wrote to memory of 1544	2388	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	extremeinjectorv3.7.2.exe
PID 2388 wrote to memory of 1544	2388	ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe	extremeinjectorv3.7.2.exe

C:\Users\Admin\AppData\Local\Temp\ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe
"C:\Users\Admin\AppData\Local\Temp\ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2388

C:\Users\Admin\AppData\Local\Temp\Insidious.exe
"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe
"C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5
a11acacc5f1183cf602b16479bbdb919

SHA1
62ef34a523d30a183345a1012f9abd3509218355

SHA256
ae932197671ba49b97eb4f40b1e8b316862ec493c4c6f607baa2f1afabd3d571

SHA512
247bed3a8e5e5df0f3ffa2e7406b63654da7e598e86ece4efd7813145e292f232a550eb8b389ea35d7e6ecef2e420f63dd56cbaff33745317d74e3ae51ed3e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious.exe

MD5
a11acacc5f1183cf602b16479bbdb919

SHA1
62ef34a523d30a183345a1012f9abd3509218355

SHA256
ae932197671ba49b97eb4f40b1e8b316862ec493c4c6f607baa2f1afabd3d571

SHA512
247bed3a8e5e5df0f3ffa2e7406b63654da7e598e86ece4efd7813145e292f232a550eb8b389ea35d7e6ecef2e420f63dd56cbaff33745317d74e3ae51ed3e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe

MD5
c4394fb4daaf350cdbf5303d812e917e

SHA1
6a780c9f1c15e555b72640299b9c10e7927252f6

SHA256
0ac3387b6e0283c972722c2a6664ee23ac5ba10640d18b827e8732f5c57e7d2c

SHA512
585664a31ac2131efde439468f98c53423588348019edb3c767ffc9bb6a8a881959fd1f4a30d623a0e6a4cc02d180a146b37bef8679b55b111f46d2fb8fb82e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe

MD5
c4394fb4daaf350cdbf5303d812e917e

SHA1
6a780c9f1c15e555b72640299b9c10e7927252f6

SHA256
0ac3387b6e0283c972722c2a6664ee23ac5ba10640d18b827e8732f5c57e7d2c

SHA512
585664a31ac2131efde439468f98c53423588348019edb3c767ffc9bb6a8a881959fd1f4a30d623a0e6a4cc02d180a146b37bef8679b55b111f46d2fb8fb82e1

Download Submit
memory/1324-138-0x0000000000C60000-0x0000000000C62000-memory.dmp

Filesize
8KB

Download
memory/1324-132-0x00000000004C0000-0x000000000050A000-memory.dmp

Filesize
296KB

Download
memory/1324-136-0x00007FFC07F63000-0x00007FFC07F65000-memory.dmp

Filesize
8KB

Download
memory/1544-141-0x000000001FD20000-0x000000001FD5C000-memory.dmp

Filesize
240KB

Download
memory/1544-137-0x00007FFC07F63000-0x00007FFC07F65000-memory.dmp

Filesize
8KB

Download
memory/1544-139-0x00000000030B0000-0x00000000030B2000-memory.dmp

Filesize
8KB

Download
memory/1544-140-0x000000001FAC0000-0x000000001FAD2000-memory.dmp

Filesize
72KB

Download
memory/1544-135-0x0000000000DC0000-0x0000000000FAA000-memory.dmp

Filesize
1.9MB

Download
memory/1544-142-0x00000000030B2000-0x00000000030B4000-memory.dmp

Filesize
8KB

Download
memory/1544-143-0x00000000030B4000-0x00000000030B6000-memory.dmp

Filesize
8KB

Download
memory/1544-144-0x00000000030B6000-0x00000000030B8000-memory.dmp

Filesize
8KB

Download
memory/1544-145-0x00000000030B8000-0x00000000030BA000-memory.dmp

Filesize
8KB

Download
memory/1544-146-0x00000000030BA000-0x00000000030BF000-memory.dmp

Filesize
20KB

Download
memory/1544-147-0x000000001B8C0000-0x000000001B8C4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads