44caliber | b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b

General

Target

b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe
Size

274KB
MD5

1774b03fe04c0912378903346f6d807a
SHA1

33fbaeeb05bfe3e985af80a4f400dbc236fa51bd
SHA256

b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b
SHA512

8a76d27bc58ccc481bbdaa726483bf84b8a5c3e6512b6259a26b64fffea697900edc1efe5405c9b6a6ac61fbcc8bc0653b506692dde7f1c1251692595bd4aec0

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/943405830781427732/bWrTiH0DBogSkJQzwQGoq_flifTRESk2r9Ezawioxg9zPGU0YKxSBP93A3sfQaAMshgX

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 freegeoip.app
22 freegeoip.app

flow	ioc
23	freegeoip.app
22	freegeoip.app

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exeMusNotifyIcon.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe

pid	process
2664	b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe
2664	b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe
2664	b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe
2664	b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe

description pid process

Token: SeDebugPrivilege 2664 b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe

description	pid	process
Token: SeDebugPrivilege	2664	b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe

C:\Users\Admin\AppData\Local\Temp\b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe
"C:\Users\Admin\AppData\Local\Temp\b05617170e474f6689b3c8bbf653e48b3b335d9924140f891a44327fe10cec8b.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 0
1⤵
- Checks processor information in registry
PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-130-0x0000000000610000-0x000000000065A000-memory.dmp

Filesize
296KB

Download
memory/2664-131-0x00007FFE06DE3000-0x00007FFE06DE5000-memory.dmp

Filesize
8KB

Download
memory/2664-132-0x000000001C7E0000-0x000000001C7E2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing