44caliber | 8b919845a9b13861d7095a64e5e2db3298021bccc7962fd7995b9de9e76b268f

General

Target

8b919845a9b13861d7095a64e5e2db3298021bccc7962fd7995b9de9e76b268f.exe
Size

3.2MB
MD5

e96c81e32069fcfb94da98c9be02a855
SHA1

bd4146f93ce56aeac1ec5b5ac9fe5af1dab81701
SHA256

8b919845a9b13861d7095a64e5e2db3298021bccc7962fd7995b9de9e76b268f
SHA512

8df7a9b026dc1a4a7aa7567cc5db31fded149126cb5782ee76e9a433ea37194bdcd2b69070daf7a3ee8a866d939d40ec9204f79453bef85b397bc70840e273b3
SSDEEP

49152:YIun087q30q/a6rrfvitpxOUMlHUK5XejfEOVpZ6MZj9X5myer3lPO8H5u:YL0OzqS6rr2YxlHejsO3Z9Z/m9re

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1150051435472498830/YhoiwXwAAKsBrBSJ0St12JGqZ_ebCKHh9rfhnswtrjkVxmov8EdH-iOO0gTBXrngx-L8

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation	8b919845a9b13861d7095a64e5e2db3298021bccc7962fd7995b9de9e76b268f.exe

Executes dropped EXE 1 IoCs

pid	Process
872	F2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	freegeoip.app
31	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	F2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	F2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
872	F2.exe
872	F2.exe
872	F2.exe
872	F2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	F2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 872	3344	8b919845a9b13861d7095a64e5e2db3298021bccc7962fd7995b9de9e76b268f.exe	86
PID 3344 wrote to memory of 872	3344	8b919845a9b13861d7095a64e5e2db3298021bccc7962fd7995b9de9e76b268f.exe	86

C:\Users\Admin\AppData\Local\Temp\8b919845a9b13861d7095a64e5e2db3298021bccc7962fd7995b9de9e76b268f.exe
"C:\Users\Admin\AppData\Local\Temp\8b919845a9b13861d7095a64e5e2db3298021bccc7962fd7995b9de9e76b268f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Local\Temp\F2.exe
  "C:\Users\Admin\AppData\Local\Temp\F2.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F2.exe

Filesize
274KB

MD5
39ff6663f1a341e3ee70073244014988

SHA1
8ccfae8001536cc2386cda09cd257a29d5e61f81

SHA256
d3654319e1b0e888468008ef9190923bd9e5098e7aca7e1e661ea896d9ed1d9e

SHA512
2f3da46a50003e13bb0b4d88a0eb7878fc1c1b98e091cc2a3352922c93b98a7f46f8ad07a77c7be8faec0ebb421e03a06321a949c9ce1d481f64a5366658d1ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2.exe

Filesize
274KB

MD5
39ff6663f1a341e3ee70073244014988

SHA1
8ccfae8001536cc2386cda09cd257a29d5e61f81

SHA256
d3654319e1b0e888468008ef9190923bd9e5098e7aca7e1e661ea896d9ed1d9e

SHA512
2f3da46a50003e13bb0b4d88a0eb7878fc1c1b98e091cc2a3352922c93b98a7f46f8ad07a77c7be8faec0ebb421e03a06321a949c9ce1d481f64a5366658d1ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2.exe

Filesize
274KB

MD5
39ff6663f1a341e3ee70073244014988

SHA1
8ccfae8001536cc2386cda09cd257a29d5e61f81

SHA256
d3654319e1b0e888468008ef9190923bd9e5098e7aca7e1e661ea896d9ed1d9e

SHA512
2f3da46a50003e13bb0b4d88a0eb7878fc1c1b98e091cc2a3352922c93b98a7f46f8ad07a77c7be8faec0ebb421e03a06321a949c9ce1d481f64a5366658d1ca

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
d12986a1731487dc61d4f1411008db6d

SHA1
36b019a2073741726c8a821ec08254d4ac7832b8

SHA256
280dcb475b3bcdd4f0df51c96067b8027d76d86b456748d11f4c4c50a7e4e207

SHA512
0b445dea40539e61792cc65c7676fca08884bf2a16fb4a47a56837d0cd3e3704f3c9ebd27d4c6731f7c716087fcbd3538851f455345e30ad71abb27eabf3394a

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
d12986a1731487dc61d4f1411008db6d

SHA1
36b019a2073741726c8a821ec08254d4ac7832b8

SHA256
280dcb475b3bcdd4f0df51c96067b8027d76d86b456748d11f4c4c50a7e4e207

SHA512
0b445dea40539e61792cc65c7676fca08884bf2a16fb4a47a56837d0cd3e3704f3c9ebd27d4c6731f7c716087fcbd3538851f455345e30ad71abb27eabf3394a

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
d12986a1731487dc61d4f1411008db6d

SHA1
36b019a2073741726c8a821ec08254d4ac7832b8

SHA256
280dcb475b3bcdd4f0df51c96067b8027d76d86b456748d11f4c4c50a7e4e207

SHA512
0b445dea40539e61792cc65c7676fca08884bf2a16fb4a47a56837d0cd3e3704f3c9ebd27d4c6731f7c716087fcbd3538851f455345e30ad71abb27eabf3394a

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
d12986a1731487dc61d4f1411008db6d

SHA1
36b019a2073741726c8a821ec08254d4ac7832b8

SHA256
280dcb475b3bcdd4f0df51c96067b8027d76d86b456748d11f4c4c50a7e4e207

SHA512
0b445dea40539e61792cc65c7676fca08884bf2a16fb4a47a56837d0cd3e3704f3c9ebd27d4c6731f7c716087fcbd3538851f455345e30ad71abb27eabf3394a

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
f8f3617eca200bf4fd972dc185305e2f

SHA1
cbfbf499092dec60992f966a53d41dc2bc229e79

SHA256
f145e1a7d964fb07619538a1cacb070a20e1bcedc06f96573e6a8efe5430557e

SHA512
66141a05d70a45204a46cd6bbf755bddfbcaa3e9017121d77ee8cc92e5a56ad7b670e19039dd18e2940aa6c51a02153c67a1e799b2712dc641e276f250688b54

Download Submit
memory/872-14-0x000001AF15CF0000-0x000001AF15D3A000-memory.dmp

Filesize
296KB

Download
memory/872-19-0x000001AF30360000-0x000001AF30370000-memory.dmp

Filesize
64KB

Download
memory/872-15-0x00007FFDB3720000-0x00007FFDB41E1000-memory.dmp

Filesize
10.8MB

Download
memory/872-137-0x00007FFDB3720000-0x00007FFDB41E1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads