Analysis
-
max time kernel
133s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
12-03-2022 20:36
General
-
Target
MentalRun.exe
-
Size
274KB
-
MD5
18430d2473925ac89be6519d60022979
-
SHA1
a48a0badf5ab80de630fc0afaa79fc69a5bc18bb
-
SHA256
ab49f788d53435b9657f8f1e2dd58de104d52ffa9fb97898aed8f44e7354efbc
-
SHA512
6390bcd592ea313535a474bba33d4523a1e773921337d47cbb020cbbe61c2f35ff386de2b12f2eb1035624748421febd41df210480dc10d63927608ebf333385
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/951565322840862730/4aE4j6x4YXP3eBMbzUkURTY1g4UU99pU7a5DSU5qjg8GlmmffMOrYrR7kIL2_UkoKXuM
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Detected executables Discord URL observed in first stage droppers 1 IoCs
DISCORD URLS.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MentalRun.exe"C:\Users\Admin\AppData\Local\Temp\MentalRun.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
10.8MB
-
Filesize
8KB