Analysis
-
max time kernel
74s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
23-09-2023 18:45
General
-
Target
Yandex.bin.exe
-
Size
274KB
-
MD5
40e3881d6c0898f6a5c24940b54a69a2
-
SHA1
f3da392ee4fb703255eff7ee8a83f23c2bb02987
-
SHA256
d5c05da57fa20048e35e6ef498b3dd0bcb92eaea3997e8a7009b38b8a15c4e86
-
SHA512
9013a696cda9be776f0a5ee66aece8716662121e69c5be056c8567eabed8fea91641e50714962438efb57da1b1ff1d4a2c3211e65be10a9e7833e647f700eb8b
-
SSDEEP
6144:ef+BLtABPDMtBBfn1Y0gIoHOQZafTy8lI1D0Cbg:1tVvgIoHO+x1DRg
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1155120137612034188/cdy5wHbWmzOOyiX6nZbn5OlBuBidB8er7f1281hl7JRUP1iVFGnh9s57SwGqJtsdtgrx
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yandex.bin.exe"C:\Users\Admin\AppData\Local\Temp\Yandex.bin.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
740B
MD5b84b949f6d0b4822c460c26050f20161
SHA182828a61f5349b9a626292e08a246ee7b6dd2886
SHA25659afde415cbddb979d24c45edcf9d5d8f1113282c59114182ec44c66f763cc47
SHA5120249e408ad2d446a5232e601b1b6d5d76275ab7075da327d2cdebfbbdd6e09c0e974dbfab9832656f7313cb838b97f7e31b202729520f0d8ea4181c1f722a1d2
-
Filesize
1KB
MD57764529fa27ef0ebf3952bd05503e58e
SHA140b27d0b156d97137a92bd6068c384ab8c07aa32
SHA256b284bc3e15fa063c9b1cb3e55d18de05de51289238bb913ca008bd00f30927d6
SHA512532f64936dc4139db25dc81d7137b44dbf17ccc3891ce8c3e8ca008e49dfc13363d99c70bcda14d9cbe06fa0ddf56e7eebfb7992544d57ee3992bc4052cf229e
-
Filesize
1KB
MD57764529fa27ef0ebf3952bd05503e58e
SHA140b27d0b156d97137a92bd6068c384ab8c07aa32
SHA256b284bc3e15fa063c9b1cb3e55d18de05de51289238bb913ca008bd00f30927d6
SHA512532f64936dc4139db25dc81d7137b44dbf17ccc3891ce8c3e8ca008e49dfc13363d99c70bcda14d9cbe06fa0ddf56e7eebfb7992544d57ee3992bc4052cf229e
-
Filesize
296KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB