44caliber | a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44

General

Target

Cryptded_protected.exe
Size

1.5MB
MD5

fc24752914e03759c7cc97e560154868
SHA1

9790816345ee7f10a0336f4013864c565c75de89
SHA256

a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44
SHA512

7a7082c640fbcb54a9247848dde589258a7182ff2284c166372465f5d7a76ab3ce89cc7d98bba9fab3a670957655e8fb0337cd7f836cc1f88ccfe6aa980f904e

Score

10^/10

44caliber njrat evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/963884131157168128/l7y0A3as75Se94o7XMk4zXPVahSSRfUXKz2j0cONgRgga6ZiO0oAtr3nqCmT9TlwHPnJ

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

Umbrella.flv.exeInsidious (2).exesvhost.exe

pid process

4932 Umbrella.flv.exe
4832 Insidious (2).exe
2980 svhost.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2032 netsh.exe

pid	process
4932	Umbrella.flv.exe
4832	Insidious (2).exe
2980	svhost.exe

pid	process
2032	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Cryptded_protected.exeUmbrella.flv.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	Cryptded_protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	Umbrella.flv.exe

Drops startup file 2 IoCs

Processes:

svhost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbf292fcc15f8937d92f60f5f6be68ce.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbf292fcc15f8937d92f60f5f6be68ce.exe	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cbf292fcc15f8937d92f60f5f6be68ce = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cbf292fcc15f8937d92f60f5f6be68ce = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 freegeoip.app
7 freegeoip.app
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

svhost.exe

description ioc process

File created C:\autorun.inf svhost.exe
File opened for modification C:\autorun.inf svhost.exe
File created D:\autorun.inf svhost.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Cryptded_protected.exe

pid process

8 Cryptded_protected.exe
8 Cryptded_protected.exe
8 Cryptded_protected.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
6	freegeoip.app
7	freegeoip.app

description	ioc	process
File created	C:\autorun.inf	svhost.exe
File opened for modification	C:\autorun.inf	svhost.exe
File created	D:\autorun.inf	svhost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Insidious (2).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious (2).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious (2).exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4880 taskkill.exe

pid	process
4880	taskkill.exe

Modifies registry class 1 IoCs

Processes:

Cryptded_protected.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Cryptded_protected.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Cryptded_protected.exeInsidious (2).exepowershell.exesvhost.exe

pid	process
8	Cryptded_protected.exe
8	Cryptded_protected.exe
4832	Insidious (2).exe
4832	Insidious (2).exe
4832	Insidious (2).exe
4832	Insidious (2).exe
2248	powershell.exe
2248	powershell.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe
2980	svhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svhost.exe

pid process

2980 svhost.exe

pid	process
2980	svhost.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

Insidious (2).exepowershell.exesvhost.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4832	Insidious (2).exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2980	svhost.exe
Token: SeDebugPrivilege	4880	taskkill.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe
Token: 33	2980	svhost.exe
Token: SeIncBasePriorityPrivilege	2980	svhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Cryptded_protected.exe

pid process

8 Cryptded_protected.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Cryptded_protected.exeUmbrella.flv.exesvhost.exe

description	pid	process	target process
PID 8 wrote to memory of 4932	8	Cryptded_protected.exe	Umbrella.flv.exe
PID 8 wrote to memory of 4932	8	Cryptded_protected.exe	Umbrella.flv.exe
PID 8 wrote to memory of 4932	8	Cryptded_protected.exe	Umbrella.flv.exe
PID 8 wrote to memory of 4832	8	Cryptded_protected.exe	Insidious (2).exe
PID 8 wrote to memory of 4832	8	Cryptded_protected.exe	Insidious (2).exe
PID 8 wrote to memory of 2248	8	Cryptded_protected.exe	powershell.exe
PID 8 wrote to memory of 2248	8	Cryptded_protected.exe	powershell.exe
PID 8 wrote to memory of 2248	8	Cryptded_protected.exe	powershell.exe
PID 4932 wrote to memory of 2980	4932	Umbrella.flv.exe	svhost.exe
PID 4932 wrote to memory of 2980	4932	Umbrella.flv.exe	svhost.exe
PID 4932 wrote to memory of 2980	4932	Umbrella.flv.exe	svhost.exe
PID 2980 wrote to memory of 2032	2980	svhost.exe	netsh.exe
PID 2980 wrote to memory of 2032	2980	svhost.exe	netsh.exe
PID 2980 wrote to memory of 2032	2980	svhost.exe	netsh.exe
PID 2980 wrote to memory of 4880	2980	svhost.exe	taskkill.exe
PID 2980 wrote to memory of 4880	2980	svhost.exe	taskkill.exe
PID 2980 wrote to memory of 4880	2980	svhost.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe
"C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8

C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe
"C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4932

C:\Users\Admin\AppData\Roaming\svhost.exe
"C:\Users\Admin\AppData\Roaming\svhost.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Exsample.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe
"C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $file='C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe';for($i=1;$i -le 600 -and (Test-Path $file -PathType leaf);$i++){Remove-Item $file;Start-Sleep -m 100}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe
Filesize
252KB

MD5
d7595446b3398cd3f737047a2ea51e6b

SHA1
3149f2afed1ee0b7b64afcd0ddfe52b982c07983

SHA256
a09ef6e960ea808cfd8d3031957e7d8213b03b8ce37e2cafe905d43965635975

SHA512
dc95b3a9117f1e52e735b316a2828e649a904120c604505d071d70f5fdeba40396f1de8f39292e9651deeed6fcb2447026c63383491b080abb9416839bbcd00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe
Filesize
252KB

MD5
d7595446b3398cd3f737047a2ea51e6b

SHA1
3149f2afed1ee0b7b64afcd0ddfe52b982c07983

SHA256
a09ef6e960ea808cfd8d3031957e7d8213b03b8ce37e2cafe905d43965635975

SHA512
dc95b3a9117f1e52e735b316a2828e649a904120c604505d071d70f5fdeba40396f1de8f39292e9651deeed6fcb2447026c63383491b080abb9416839bbcd00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
memory/8-141-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/8-131-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/8-132-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/8-130-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/2032-161-0x0000000000000000-mapping.dmp

Download
memory/2248-146-0x00000000052A0000-0x00000000052C2000-memory.dmp

Filesize
136KB

Download
memory/2248-152-0x00000000067C0000-0x00000000067DA000-memory.dmp

Filesize
104KB

Download
memory/2248-155-0x0000000008560000-0x0000000008BDA000-memory.dmp

Filesize
6.5MB

Download
memory/2248-144-0x0000000002910000-0x0000000002946000-memory.dmp

Filesize
216KB

Download
memory/2248-145-0x00000000055C0000-0x0000000005BE8000-memory.dmp

Filesize
6.2MB

Download
memory/2248-140-0x0000000000000000-mapping.dmp

Download
memory/2248-147-0x0000000005500000-0x0000000005566000-memory.dmp

Filesize
408KB

Download
memory/2248-148-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Filesize
408KB

Download
memory/2248-149-0x00000000062D0000-0x00000000062EE000-memory.dmp

Filesize
120KB

Download
memory/2248-154-0x0000000007930000-0x0000000007ED4000-memory.dmp

Filesize
5.6MB

Download
memory/2248-151-0x00000000068A0000-0x0000000006936000-memory.dmp

Filesize
600KB

Download
memory/2248-153-0x0000000006830000-0x0000000006852000-memory.dmp

Filesize
136KB

Download
memory/2980-156-0x0000000000000000-mapping.dmp

Download
memory/2980-160-0x0000000072B20000-0x00000000730D1000-memory.dmp

Filesize
5.7MB

Download
memory/2980-163-0x0000000072B20000-0x00000000730D1000-memory.dmp

Filesize
5.7MB

Download
memory/4832-142-0x00007FF8D7140000-0x00007FF8D7C01000-memory.dmp

Filesize
10.8MB

Download
memory/4832-150-0x00007FF8D7140000-0x00007FF8D7C01000-memory.dmp

Filesize
10.8MB

Download
memory/4832-139-0x00000000002A0000-0x00000000002E6000-memory.dmp

Filesize
280KB

Download
memory/4832-136-0x0000000000000000-mapping.dmp

Download
memory/4880-162-0x0000000000000000-mapping.dmp

Download
memory/4932-143-0x0000000072B20000-0x00000000730D1000-memory.dmp

Filesize
5.7MB

Download
memory/4932-159-0x0000000072B20000-0x00000000730D1000-memory.dmp

Filesize
5.7MB

Download
memory/4932-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads