Analysis
-
max time kernel
113s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-05-2022 14:04
General
-
Target
d2fa23ff3612073d344a51d35531337b.exe
-
Size
274KB
-
MD5
d2fa23ff3612073d344a51d35531337b
-
SHA1
868935912e8a7b2c2a7fa9953203aa49ed03403d
-
SHA256
72c486f862e71725ec5b05df3f273fee8ccd02b358d6e817d43e8f7f939980f9
-
SHA512
637ce0f72f9ed1b9299f2e9b42c6e4fd0f83a7b947e25e82f5ae1b2814cfc11245f348eee9528a9269ef670aff3fcfc6dfe0db3c5b7ccedaad37dcbd7ed6b62d
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/868165756532179044/9Wht5QRwQI22RKhTqTychIaUX8rzws89p6FHzVstwwhhwpV9IhRLu6rdsBCywp4HVXuZ
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2fa23ff3612073d344a51d35531337b.exe"C:\Users\Admin\AppData\Local\Temp\d2fa23ff3612073d344a51d35531337b.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
10.8MB