44caliber | 1a7c622544bc7fce75780a488bbf9d66a68176405c40d196a7afb7124244bd41

General

Target

05665999.exe
Size

718KB
MD5

e5701891f96e5727971f223551b64f45
SHA1

dcc476ee7b6c9bb75195c1ab81512d5c6efacd40
SHA256

1a7c622544bc7fce75780a488bbf9d66a68176405c40d196a7afb7124244bd41
SHA512

2c8a44b882bce13e226ab0a7941c57a8b383c793626cf15a16e81abbcaa033b78a536cbeb03e2bdbd4c923102bb6d967f90e4cc38570fb2f5ebd32706da9e998
SSDEEP

12288:jccr2M0k0CTUxid6rfBCWxskGxo5PlAXY5sMIGH/c4j:IcpBjN6rfBCWmx42I5HIGfcY

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/1049356312187772968/RhGBI5VRUa2070gE61YTrZzr1G_QOPG0A5RvRIUDuTemlVPlposGOfVeFkkYgdFFQO5I

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

05665999.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	05665999.exe

Executes dropped EXE 2 IoCs

Processes:

Insidious.exeloader.exe

pid process

4964 Insidious.exe
4980 loader.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 freegeoip.app
16 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4964	Insidious.exe
4980	loader.exe

flow	ioc
15	freegeoip.app
16	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Insidious.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Insidious.exe

pid process

4964 Insidious.exe
4964 Insidious.exe
4964 Insidious.exe
4964 Insidious.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Insidious.exe

description pid process

Token: SeDebugPrivilege 4964 Insidious.exe

pid	process
4964	Insidious.exe
4964	Insidious.exe
4964	Insidious.exe
4964	Insidious.exe

description	pid	process
Token: SeDebugPrivilege	4964	Insidious.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

05665999.exeloader.exe

description	pid	process	target process
PID 4532 wrote to memory of 4964	4532	05665999.exe	Insidious.exe
PID 4532 wrote to memory of 4964	4532	05665999.exe	Insidious.exe
PID 4532 wrote to memory of 4980	4532	05665999.exe	loader.exe
PID 4532 wrote to memory of 4980	4532	05665999.exe	loader.exe
PID 4532 wrote to memory of 4980	4532	05665999.exe	loader.exe
PID 4980 wrote to memory of 4424	4980	loader.exe	javaw.exe
PID 4980 wrote to memory of 4424	4980	loader.exe	javaw.exe

C:\Users\Admin\AppData\Local\Temp\05665999.exe
"C:\Users\Admin\AppData\Local\Temp\05665999.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4532

C:\Users\Admin\AppData\Local\Temp\Insidious.exe
"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\loader.exe"
3⤵
PID:4424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Insidious.exe

Filesize
274KB

MD5
082a96ffc0b5c79bba76f7614a855ee3

SHA1
b44a3ced7c9db4dc25ff5235d2b8e7ffb64200f7

SHA256
ee8cec604cd3b8273898f378a6a9490b7d530df3d7841c22b41b003d688543a9

SHA512
85dc97673d1967670e953897d51a9ca012860759a27b15d4668fb961184ecf2e49a7c32216bede507246828c4aa114eb8b04bec4579b096b38d0fa0f7603b526

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious.exe

Filesize
274KB

MD5
082a96ffc0b5c79bba76f7614a855ee3

SHA1
b44a3ced7c9db4dc25ff5235d2b8e7ffb64200f7

SHA256
ee8cec604cd3b8273898f378a6a9490b7d530df3d7841c22b41b003d688543a9

SHA512
85dc97673d1967670e953897d51a9ca012860759a27b15d4668fb961184ecf2e49a7c32216bede507246828c4aa114eb8b04bec4579b096b38d0fa0f7603b526

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious.exe

Filesize
274KB

MD5
082a96ffc0b5c79bba76f7614a855ee3

SHA1
b44a3ced7c9db4dc25ff5235d2b8e7ffb64200f7

SHA256
ee8cec604cd3b8273898f378a6a9490b7d530df3d7841c22b41b003d688543a9

SHA512
85dc97673d1967670e953897d51a9ca012860759a27b15d4668fb961184ecf2e49a7c32216bede507246828c4aa114eb8b04bec4579b096b38d0fa0f7603b526

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
610KB

MD5
1ff7c7c08621c82d68330f0f5a15fb46

SHA1
2930047d59c82f2c943bbbe766389474995617a7

SHA256
479c4f5c81bf090205a00f953c03400c3a411c731caffa75b67c280a4cbe5c81

SHA512
491ad95296a048b1fc609d8c9ceb8ba4383f8b452a8c273d9d869539adb2f7f8c343d9072acf4a86d4c0d9d679e7da6dcb8527484a728e3c32fb1c0f42370e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
610KB

MD5
1ff7c7c08621c82d68330f0f5a15fb46

SHA1
2930047d59c82f2c943bbbe766389474995617a7

SHA256
479c4f5c81bf090205a00f953c03400c3a411c731caffa75b67c280a4cbe5c81

SHA512
491ad95296a048b1fc609d8c9ceb8ba4383f8b452a8c273d9d869539adb2f7f8c343d9072acf4a86d4c0d9d679e7da6dcb8527484a728e3c32fb1c0f42370e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
610KB

MD5
1ff7c7c08621c82d68330f0f5a15fb46

SHA1
2930047d59c82f2c943bbbe766389474995617a7

SHA256
479c4f5c81bf090205a00f953c03400c3a411c731caffa75b67c280a4cbe5c81

SHA512
491ad95296a048b1fc609d8c9ceb8ba4383f8b452a8c273d9d869539adb2f7f8c343d9072acf4a86d4c0d9d679e7da6dcb8527484a728e3c32fb1c0f42370e67

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
2f56b34243ba810be061de92daf0e716

SHA1
9f3e08f9355486acfae15a97c8f1ef858599b653

SHA256
1bc19f02ecfc8307f4c788871fb89a4406040dcfa1ad9f37f6f1ac89d57b299c

SHA512
d819da0391ad0a2778ffb68df1d64c3d26509bff9ad87595633afea6bfbf2feb9dfabad6f9a17aca33f73d7f387d46e4a8ed8fbd7139b4a248fecf99ce935702

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
2f56b34243ba810be061de92daf0e716

SHA1
9f3e08f9355486acfae15a97c8f1ef858599b653

SHA256
1bc19f02ecfc8307f4c788871fb89a4406040dcfa1ad9f37f6f1ac89d57b299c

SHA512
d819da0391ad0a2778ffb68df1d64c3d26509bff9ad87595633afea6bfbf2feb9dfabad6f9a17aca33f73d7f387d46e4a8ed8fbd7139b4a248fecf99ce935702

Download Submit
memory/4424-331-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4424-196-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4424-334-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4424-388-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4424-409-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4424-421-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4424-423-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4964-189-0x000001F622B20000-0x000001F622B30000-memory.dmp

Filesize
64KB

Download
memory/4964-155-0x000001F608540000-0x000001F60858A000-memory.dmp

Filesize
296KB

Download
memory/4980-160-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads