44caliber | 1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca

Analysis

max time kernel
141s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe
Size

1.5MB
MD5

5a59e468b8d917cb8ab8283f4cc3c73a
SHA1

544420b225c36f3659357534d992cc2e2282b7c0
SHA256

1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca
SHA512

4f3852de36ad5c486ed8094c0de5ac77fd2e0efdb22ce2cc26bf16628c21b7ac5425dc1634696639b9c62f3e5af350a9c3c48125326bb5801cf3d98a42665bfc
SSDEEP

49152:Fsva6rr9EVAfGqEcBD2JS1NPa/LOj79eB:Fsy6GV32pPReB

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1169532958714105867/1ybbaEcwmEndkiHlxdGAYEwGK_q_-J5R_WsnfnPVVZlR8Zo9npE1_nuHQba2_1sthVX_

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Executes dropped EXE 1 IoCs

Processes:

Loader.exe

pid process

1720 Loader.exe

pid	process
1720	Loader.exe

Loads dropped DLL 9 IoCs

Processes:

1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exeWerFault.exe

pid	process
1768	1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe
1768	1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe
1768	1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe
1768	1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Loader.exe

pid process

1720 Loader.exe
1720 Loader.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2700 1720 WerFault.exe Loader.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Loader.exe

pid process

1720 Loader.exe
1720 Loader.exe
1720 Loader.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Loader.exe

description pid process

Token: SeDebugPrivilege 1720 Loader.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Loader.exe

pid process

1720 Loader.exe

pid	process
1720	Loader.exe
1720	Loader.exe

pid	pid_target	process	target process
2700	1720	WerFault.exe	Loader.exe

pid	process
1720	Loader.exe
1720	Loader.exe
1720	Loader.exe

description	pid	process
Token: SeDebugPrivilege	1720	Loader.exe

pid	process
1720	Loader.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exeLoader.exe

description	pid	process	target process
PID 1768 wrote to memory of 1720	1768	1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe	Loader.exe
PID 1768 wrote to memory of 1720	1768	1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe	Loader.exe
PID 1768 wrote to memory of 1720	1768	1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe	Loader.exe
PID 1768 wrote to memory of 1720	1768	1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe	Loader.exe
PID 1720 wrote to memory of 2700	1720	Loader.exe	WerFault.exe
PID 1720 wrote to memory of 2700	1720	Loader.exe	WerFault.exe
PID 1720 wrote to memory of 2700	1720	Loader.exe	WerFault.exe
PID 1720 wrote to memory of 2700	1720	Loader.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe
"C:\Users\Admin\AppData\Local\Temp\1f2a8237d80c320b6c6ca9c3edeebc244dd3c6708e851a6798263c619eae9aca.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 1152
3⤵
- Loads dropped DLL
- Program crash
PID:2700

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
\??\c:\users\admin\appdata\local\temp\rarsfx0\loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.exe
Filesize
1.2MB

MD5
d372d261329ae8563988a45e98e74f3a

SHA1
6ce094dc64d42e4a43d7c7aa26cc72014b5b93da

SHA256
d567ba0373f7eccbb3b13fff03449b763131fefc54665f4911bc7e386805653e

SHA512
7a10b79116a36783937959ba8d1c76736eb6699dbd5983089fd2a88cd9415851ff85bb0ac74971fbfa22830d6c2793dd8f4b2731609b19a6516422b0f14d6afc

Download Submit
memory/1720-20-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-21-0x00000000054B0000-0x00000000054F0000-memory.dmp

Filesize
256KB

Download
memory/1720-19-0x00000000008B0000-0x0000000000C68000-memory.dmp

Filesize
3.7MB

Download
memory/1720-17-0x00000000008B0000-0x0000000000C68000-memory.dmp

Filesize
3.7MB

Download
memory/1720-48-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-49-0x00000000054B0000-0x00000000054F0000-memory.dmp

Filesize
256KB

Download
memory/1768-15-0x0000000003AA0000-0x0000000003E58000-memory.dmp

Filesize
3.7MB

Download
memory/1768-7-0x0000000003AA0000-0x0000000003E58000-memory.dmp

Filesize
3.7MB

Download