44caliber | c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f

General

Target

c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe
Size

274KB
MD5

e94364b4239eb39286dd3b07a9ea469c
SHA1

95a3fc71b5a4f63e1ce10c163af55b56f168a6f8
SHA256

c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f
SHA512

bb924f1c1f8b851c70d5639abed43ed047452bac62580d060229e7a054d5f1be269e2888a3dfe511b434ac5a785dcf37216c95cffd8baaa9432cd930670acc13
SSDEEP

6144:8f+BLtABPDWlR1ZroWT0Ilb5wqlYeJ6lA1D0wIk:RluK0Ilb5/lYed1DMk

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1101119692103491584/GTMNvMSwfNfgMdtSqTcvjCvj1QDXJYPNxW9vEtgHszOELGeSAQDBrIp9Qf7oWif26BJd

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 freegeoip.app
8 freegeoip.app

flow	ioc
7	freegeoip.app
8	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe

pid	process
968	c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe
968	c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe
968	c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe
968	c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe

description pid process

Token: SeDebugPrivilege 968 c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe

description	pid	process
Token: SeDebugPrivilege	968	c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe

C:\Users\Admin\AppData\Local\Temp\c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c2ade6498bf4fe3991c76104a2d5a8ad880ab4baaf0756f707eb3b22d9734a8f_JC.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
266B

MD5
e3fd5c9ec84dd57090aa018e73392ae8

SHA1
90309a4a6dc16b9bdd40413eaea6bd6847bd00e8

SHA256
2b762cd1175b40c6ae1722567330d9f61876e9961eac057891194e053bb0eaac

SHA512
9d1a6967e29aaa49ed0b3fe04691324b3a10f04ba4077e47ae9d854f9612cae5e3f5c414e3b4f9a9be3c549eb879205b14490c28dd820b137ca906e923185a62

Download Submit
C:\ProgramData\44\Process.txt

Filesize
839B

MD5
d1c539acd70489579bdef691b969d257

SHA1
227c31ad68caa80c53d3ca74dc51a231700494b4

SHA256
36b1612704c6a22186341e2c7b5f91975f705715f6bfea89a1d382a5b867da1e

SHA512
a011d0cdb842db9ace423925fa7b02b315ec509403c20dbea2b715c904190960d2daa7e76ce90b4a78403ab39e70362008524352a01bb5fecf203ff4dd286288

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
17252c103bf08c1a92b99cb1d17d757d

SHA1
1ac9868b0e442a06bd13070a08955ef32bbce872

SHA256
ddb56c104d73fd425dab4b07b108e60b3ddd430ac86978c67075f5c00009fd6d

SHA512
b4e7cd35a3c68a605f910221bf391ba3e00da730b659d37322340078793f4222e5c6946c367869c9bc0d112b3b4d76dec264f234b29dcc1fd90a9bcf28f0e95e

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
17252c103bf08c1a92b99cb1d17d757d

SHA1
1ac9868b0e442a06bd13070a08955ef32bbce872

SHA256
ddb56c104d73fd425dab4b07b108e60b3ddd430ac86978c67075f5c00009fd6d

SHA512
b4e7cd35a3c68a605f910221bf391ba3e00da730b659d37322340078793f4222e5c6946c367869c9bc0d112b3b4d76dec264f234b29dcc1fd90a9bcf28f0e95e

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
17252c103bf08c1a92b99cb1d17d757d

SHA1
1ac9868b0e442a06bd13070a08955ef32bbce872

SHA256
ddb56c104d73fd425dab4b07b108e60b3ddd430ac86978c67075f5c00009fd6d

SHA512
b4e7cd35a3c68a605f910221bf391ba3e00da730b659d37322340078793f4222e5c6946c367869c9bc0d112b3b4d76dec264f234b29dcc1fd90a9bcf28f0e95e

Download Submit
memory/968-0-0x0000024F46210000-0x0000024F4625A000-memory.dmp

Filesize
296KB

Download
memory/968-32-0x0000024F47EE0000-0x0000024F47EF0000-memory.dmp

Filesize
64KB

Download
memory/968-31-0x00007FF8FBFD0000-0x00007FF8FCA91000-memory.dmp

Filesize
10.8MB

Download
memory/968-33-0x00007FF8FBFD0000-0x00007FF8FCA91000-memory.dmp

Filesize
10.8MB

Download
memory/968-34-0x0000024F47EE0000-0x0000024F47EF0000-memory.dmp

Filesize
64KB

Download
memory/968-124-0x00007FF8FBFD0000-0x00007FF8FCA91000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing