Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
01/03/2022, 18:13
General
- Target ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe
- Size 2.2MB
- Sample220301-wt6cqacfer
- SHA256 ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22
Malware Config
Extracted
-
44caliber
-
https://discord.com/api/webhooks/839168546582954067/texAC9z_H7M0ROD6-MdvYy3D-z8YyP9fYGPhFfDYeop5TtilvsKNxw5QrTXStp-JwQ9R
Signatures
- 44Caliber
An open source infostealer written in C#.
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe"C:\Users\Admin\AppData\Local\Temp\ca9d5e8d1c89d2d5e17e8012fa40e590f1628c5aa473a489076d488aecc05b22.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Insidious.exe"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe"C:\Users\Admin\AppData\Local\Temp\extremeinjectorv3.7.2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1324-138-0x0000000000C60000-0x0000000000C62000-memory.dmp
memory/1324-132-0x00000000004C0000-0x000000000050A000-memory.dmp
memory/1324-136-0x00007FFC07F63000-0x00007FFC07F65000-memory.dmp
memory/1544-141-0x000000001FD20000-0x000000001FD5C000-memory.dmp
memory/1544-137-0x00007FFC07F63000-0x00007FFC07F65000-memory.dmp
memory/1544-139-0x00000000030B0000-0x00000000030B2000-memory.dmp
memory/1544-140-0x000000001FAC0000-0x000000001FAD2000-memory.dmp
memory/1544-135-0x0000000000DC0000-0x0000000000FAA000-memory.dmp
memory/1544-142-0x00000000030B2000-0x00000000030B4000-memory.dmp
memory/1544-143-0x00000000030B4000-0x00000000030B6000-memory.dmp
memory/1544-144-0x00000000030B6000-0x00000000030B8000-memory.dmp
memory/1544-145-0x00000000030B8000-0x00000000030BA000-memory.dmp
memory/1544-146-0x00000000030BA000-0x00000000030BF000-memory.dmp
memory/1544-147-0x000000001B8C0000-0x000000001B8C4000-memory.dmp