44caliber | a011238f838b9bc61adec2897e0cac87099249a425dbc83064094fbdb987f337

General

Target

f3f3c591de1ed8ea2c00dcf8c03b86bf.exe
Size

415KB
MD5

f3f3c591de1ed8ea2c00dcf8c03b86bf
SHA1

02e9dee6e17a41b74054d11a2f0e7abc0b963b12
SHA256

a011238f838b9bc61adec2897e0cac87099249a425dbc83064094fbdb987f337
SHA512

61b2a9d6c011babe0540db4016627a584161c7fac432820424cd8c85cd85cb1ca537e1b202cceec241b99592865ace30cf9f47362563b82250053dfb63abb214
SSDEEP

6144:2TouKrWBEu3/Z2lpGDHU3ykJotX+t41/5c8gWe3JB2AgMmqP:2ToPWBv/cpGrU3yVtX+t4V5cWe5A+mqP

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1136773243261427722/PblfbxA7GVJqBDdmJ8FJrCPSUvE8iRRElfnrMu-WTqPYsrO633tdDs3xiZCowAI13ArQ

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	f3f3c591de1ed8ea2c00dcf8c03b86bf.exe

Executes dropped EXE 1 IoCs

pid	Process
4032	loader.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	freegeoip.app
7	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	loader.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4032	loader.exe
4032	loader.exe
4032	loader.exe
4032	loader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 4032	1920	f3f3c591de1ed8ea2c00dcf8c03b86bf.exe	83
PID 1920 wrote to memory of 4032	1920	f3f3c591de1ed8ea2c00dcf8c03b86bf.exe	83

C:\Users\Admin\AppData\Local\Temp\f3f3c591de1ed8ea2c00dcf8c03b86bf.exe
"C:\Users\Admin\AppData\Local\Temp\f3f3c591de1ed8ea2c00dcf8c03b86bf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
7205d28cf51761674876c57e1f06accc

SHA1
984d58b34a6550450e668898846166a94dabe5cd

SHA256
15aec2d367e71cf7dc7187c4be50a716f87f8eaecb330c76c15d275b6601d0e8

SHA512
bf46c91d86ba2449968a648951d279692537fb079ee711d5f3fb6d8e348d5e327d2e2dc0435e9e814172140c73151524d75fc017cb6a76564c2c1dde12242716

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
7205d28cf51761674876c57e1f06accc

SHA1
984d58b34a6550450e668898846166a94dabe5cd

SHA256
15aec2d367e71cf7dc7187c4be50a716f87f8eaecb330c76c15d275b6601d0e8

SHA512
bf46c91d86ba2449968a648951d279692537fb079ee711d5f3fb6d8e348d5e327d2e2dc0435e9e814172140c73151524d75fc017cb6a76564c2c1dde12242716

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
7205d28cf51761674876c57e1f06accc

SHA1
984d58b34a6550450e668898846166a94dabe5cd

SHA256
15aec2d367e71cf7dc7187c4be50a716f87f8eaecb330c76c15d275b6601d0e8

SHA512
bf46c91d86ba2449968a648951d279692537fb079ee711d5f3fb6d8e348d5e327d2e2dc0435e9e814172140c73151524d75fc017cb6a76564c2c1dde12242716

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe

Filesize
274KB

MD5
85b10f8d022b2b82aa276168da0950fe

SHA1
f0ebbadf43bd9fbd5f93706aae076f89230a643b

SHA256
fd45e5b2e40a6a427bc0b2caf7d546a63a632adaa4fe7cb70a9173f74c4c54e2

SHA512
737fccf654e342818da06adfbfa724862d5c816551e110cf94f71313186b8dc19319dcbb26affe47a9a0f7c05ecaaa564d95d1a6a2fd7c6278bddaef9347c53b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe

Filesize
274KB

MD5
85b10f8d022b2b82aa276168da0950fe

SHA1
f0ebbadf43bd9fbd5f93706aae076f89230a643b

SHA256
fd45e5b2e40a6a427bc0b2caf7d546a63a632adaa4fe7cb70a9173f74c4c54e2

SHA512
737fccf654e342818da06adfbfa724862d5c816551e110cf94f71313186b8dc19319dcbb26affe47a9a0f7c05ecaaa564d95d1a6a2fd7c6278bddaef9347c53b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe

Filesize
274KB

MD5
85b10f8d022b2b82aa276168da0950fe

SHA1
f0ebbadf43bd9fbd5f93706aae076f89230a643b

SHA256
fd45e5b2e40a6a427bc0b2caf7d546a63a632adaa4fe7cb70a9173f74c4c54e2

SHA512
737fccf654e342818da06adfbfa724862d5c816551e110cf94f71313186b8dc19319dcbb26affe47a9a0f7c05ecaaa564d95d1a6a2fd7c6278bddaef9347c53b

Download Submit
memory/4032-12-0x0000018D9CEA0000-0x0000018D9CEEA000-memory.dmp

Filesize
296KB

Download
memory/4032-33-0x00007FFE48770000-0x00007FFE49231000-memory.dmp

Filesize
10.8MB

Download
memory/4032-43-0x0000018D9EA80000-0x0000018D9EA90000-memory.dmp

Filesize
64KB

Download
memory/4032-130-0x00007FFE48770000-0x00007FFE49231000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads