44caliber | a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44

Analysis

max time kernel
151s
max time network
144s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cryptded_protected.exe
Size

1.5MB
MD5

fc24752914e03759c7cc97e560154868
SHA1

9790816345ee7f10a0336f4013864c565c75de89
SHA256

a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44
SHA512

7a7082c640fbcb54a9247848dde589258a7182ff2284c166372465f5d7a76ab3ce89cc7d98bba9fab3a670957655e8fb0337cd7f836cc1f88ccfe6aa980f904e

Score

10^/10

44caliber njrat evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/963884131157168128/l7y0A3as75Se94o7XMk4zXPVahSSRfUXKz2j0cONgRgga6ZiO0oAtr3nqCmT9TlwHPnJ

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

Umbrella.flv.exeInsidious (2).exesvhost.exe

pid process

1448 Umbrella.flv.exe
948 Insidious (2).exe
1236 svhost.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1536 netsh.exe
Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

1700 powershell.exe

pid	process
1448	Umbrella.flv.exe
948	Insidious (2).exe
1236	svhost.exe

pid	process
1536	netsh.exe

pid	process
1700	powershell.exe

Drops startup file 2 IoCs

Processes:

svhost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbf292fcc15f8937d92f60f5f6be68ce.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbf292fcc15f8937d92f60f5f6be68ce.exe	svhost.exe

Loads dropped DLL 3 IoCs

Processes:

Cryptded_protected.exeUmbrella.flv.exe

pid process

1400 Cryptded_protected.exe
1400 Cryptded_protected.exe
1448 Umbrella.flv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\cbf292fcc15f8937d92f60f5f6be68ce = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cbf292fcc15f8937d92f60f5f6be68ce = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 freegeoip.app
4 freegeoip.app
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

svhost.exe

description ioc process

File created C:\autorun.inf svhost.exe
File opened for modification C:\autorun.inf svhost.exe
File created D:\autorun.inf svhost.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Cryptded_protected.exe

pid process

1400 Cryptded_protected.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
3	freegeoip.app
4	freegeoip.app

description	ioc	process
File created	C:\autorun.inf	svhost.exe
File opened for modification	C:\autorun.inf	svhost.exe
File created	D:\autorun.inf	svhost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Insidious (2).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious (2).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious (2).exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

320 taskkill.exe

pid	process
320	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Cryptded_protected.exepowershell.exeInsidious (2).exesvhost.exe

pid	process
1400	Cryptded_protected.exe
1700	powershell.exe
948	Insidious (2).exe
948	Insidious (2).exe
948	Insidious (2).exe
948	Insidious (2).exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe
1236	svhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svhost.exe

pid process

1236 svhost.exe

pid	process
1236	svhost.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

powershell.exeInsidious (2).exesvhost.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	948	Insidious (2).exe
Token: SeDebugPrivilege	1236	svhost.exe
Token: SeDebugPrivilege	320	taskkill.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe
Token: 33	1236	svhost.exe
Token: SeIncBasePriorityPrivilege	1236	svhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Cryptded_protected.exe

pid process

1400 Cryptded_protected.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Cryptded_protected.exeUmbrella.flv.exesvhost.exe

description	pid	process	target process
PID 1400 wrote to memory of 1448	1400	Cryptded_protected.exe	Umbrella.flv.exe
PID 1400 wrote to memory of 1448	1400	Cryptded_protected.exe	Umbrella.flv.exe
PID 1400 wrote to memory of 1448	1400	Cryptded_protected.exe	Umbrella.flv.exe
PID 1400 wrote to memory of 1448	1400	Cryptded_protected.exe	Umbrella.flv.exe
PID 1400 wrote to memory of 948	1400	Cryptded_protected.exe	Insidious (2).exe
PID 1400 wrote to memory of 948	1400	Cryptded_protected.exe	Insidious (2).exe
PID 1400 wrote to memory of 948	1400	Cryptded_protected.exe	Insidious (2).exe
PID 1400 wrote to memory of 948	1400	Cryptded_protected.exe	Insidious (2).exe
PID 1400 wrote to memory of 1700	1400	Cryptded_protected.exe	powershell.exe
PID 1400 wrote to memory of 1700	1400	Cryptded_protected.exe	powershell.exe
PID 1400 wrote to memory of 1700	1400	Cryptded_protected.exe	powershell.exe
PID 1400 wrote to memory of 1700	1400	Cryptded_protected.exe	powershell.exe
PID 1448 wrote to memory of 1236	1448	Umbrella.flv.exe	svhost.exe
PID 1448 wrote to memory of 1236	1448	Umbrella.flv.exe	svhost.exe
PID 1448 wrote to memory of 1236	1448	Umbrella.flv.exe	svhost.exe
PID 1448 wrote to memory of 1236	1448	Umbrella.flv.exe	svhost.exe
PID 1236 wrote to memory of 1536	1236	svhost.exe	netsh.exe
PID 1236 wrote to memory of 1536	1236	svhost.exe	netsh.exe
PID 1236 wrote to memory of 1536	1236	svhost.exe	netsh.exe
PID 1236 wrote to memory of 1536	1236	svhost.exe	netsh.exe
PID 1236 wrote to memory of 320	1236	svhost.exe	taskkill.exe
PID 1236 wrote to memory of 320	1236	svhost.exe	taskkill.exe
PID 1236 wrote to memory of 320	1236	svhost.exe	taskkill.exe
PID 1236 wrote to memory of 320	1236	svhost.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe
"C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Roaming\svhost.exe
    "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Drops autorun.inf file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Exsample.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:320
- C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $file='C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe';for($i=1;$i -le 600 -and (Test-Path $file -PathType leaf);$i++){Remove-Item $file;Start-Sleep -m 100}
  2⤵
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe

Filesize
252KB

MD5
d7595446b3398cd3f737047a2ea51e6b

SHA1
3149f2afed1ee0b7b64afcd0ddfe52b982c07983

SHA256
a09ef6e960ea808cfd8d3031957e7d8213b03b8ce37e2cafe905d43965635975

SHA512
dc95b3a9117f1e52e735b316a2828e649a904120c604505d071d70f5fdeba40396f1de8f39292e9651deeed6fcb2447026c63383491b080abb9416839bbcd00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe

Filesize
252KB

MD5
d7595446b3398cd3f737047a2ea51e6b

SHA1
3149f2afed1ee0b7b64afcd0ddfe52b982c07983

SHA256
a09ef6e960ea808cfd8d3031957e7d8213b03b8ce37e2cafe905d43965635975

SHA512
dc95b3a9117f1e52e735b316a2828e649a904120c604505d071d70f5fdeba40396f1de8f39292e9651deeed6fcb2447026c63383491b080abb9416839bbcd00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe

Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe

Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe

Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe

Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
\Users\Admin\AppData\Local\Temp\Insidious (2).exe

Filesize
252KB

MD5
d7595446b3398cd3f737047a2ea51e6b

SHA1
3149f2afed1ee0b7b64afcd0ddfe52b982c07983

SHA256
a09ef6e960ea808cfd8d3031957e7d8213b03b8ce37e2cafe905d43965635975

SHA512
dc95b3a9117f1e52e735b316a2828e649a904120c604505d071d70f5fdeba40396f1de8f39292e9651deeed6fcb2447026c63383491b080abb9416839bbcd00c

Download Submit
\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe

Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
\Users\Admin\AppData\Roaming\svhost.exe

Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
memory/320-81-0x0000000000000000-mapping.dmp

Download
memory/948-70-0x0000000001290000-0x00000000012D6000-memory.dmp

Filesize
280KB

Download
memory/948-62-0x0000000000000000-mapping.dmp

Download
memory/1236-83-0x0000000073010000-0x00000000735BB000-memory.dmp

Filesize
5.7MB

Download
memory/1236-78-0x0000000073010000-0x00000000735BB000-memory.dmp

Filesize
5.7MB

Download
memory/1236-73-0x0000000000000000-mapping.dmp

Download
memory/1400-67-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/1400-55-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/1400-56-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/1400-54-0x0000000075E41000-0x0000000075E43000-memory.dmp

Filesize
8KB

Download
memory/1448-71-0x0000000073010000-0x00000000735BB000-memory.dmp

Filesize
5.7MB

Download
memory/1448-77-0x0000000073010000-0x00000000735BB000-memory.dmp

Filesize
5.7MB

Download
memory/1448-58-0x0000000000000000-mapping.dmp

Download
memory/1536-80-0x0000000000000000-mapping.dmp

Download
memory/1700-79-0x0000000073010000-0x00000000735BB000-memory.dmp

Filesize
5.7MB

Download
memory/1700-69-0x0000000073010000-0x00000000735BB000-memory.dmp

Filesize
5.7MB

Download
memory/1700-66-0x0000000000000000-mapping.dmp

Download