Overview

overview

10

Static

static

10

Insidious.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    185s
  • max time network
    293s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-10-2023 11:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Insidious.exe

  • Size

    303KB

  • MD5

    f31aa1d0e8e31801277a077e02cc3596

  • SHA1

    8c7cdb9936f061a730241221da623dddeeaa5dca

  • SHA256

    e526c085f182858a961dd965e704e1b61c5e8fbf702a6d9be630290165b987f9

  • SHA512

    427deb5daa82b1e92f22b921944549ebc176b2ca8661e7fe0c77b2d77e2ed537b85f64373d0cec44390f3fb8583fe1e3c307c7de963671e8cf5841687248ffae

  • SSDEEP

    6144:+dGT6MDdbICydeBfwm+CcPN8ZevarImI1D0sza:+dsom+CcV8fu1DVa

Score
10/10
44caliberspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1164891015933612082/Ol42sD8SDrB7wVefz8II7IFXtGKM6cRwW0ttrACgGEz1zA8ex_BzfKkV9EbrWvDHDbWj

Signatures

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Insidious.exe
    "C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3928
  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SuspendUnpublish.M2T"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3376-36-0x00007FF7F2990000-0x00007FF7F2A88000-memory.dmp
    Filesize

    992KB

    Download
  • memory/3376-37-0x00007FFB7EB70000-0x00007FFB7EBA4000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3376-38-0x00007FFB7E410000-0x00007FFB7E6C4000-memory.dmp
    Filesize

    2.7MB

    Download
  • memory/3376-39-0x00007FFB6DE90000-0x00007FFB6EF3B000-memory.dmp
    Filesize

    16.7MB

    Download
  • memory/3376-40-0x00007FFB71C90000-0x00007FFB71DA2000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/3928-0-0x0000025075EE0000-0x0000025075F32000-memory.dmp
    Filesize

    328KB

    Download
  • memory/3928-21-0x00007FFB6F190000-0x00007FFB6FB7C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3928-22-0x0000025077CB0000-0x0000025077CC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3928-23-0x00007FFB6F190000-0x00007FFB6FB7C000-memory.dmp
    Filesize

    9.9MB

    Download