44caliber | af0c48ca1ed3431b936d489bf1e8255a5d4182bd6164946bd6179ae3f212d0b1

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
26-11-2023 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RP.sfx.exe
Size

10.0MB
MD5

e335f71c0f053c393626691bd60a58a4
SHA1

0cc99df70cca24c5f96edf36672ea297fe71043f
SHA256

af0c48ca1ed3431b936d489bf1e8255a5d4182bd6164946bd6179ae3f212d0b1
SHA512

eaa5b09100e133cd7241258255c02be262d3f6061774f9d32424922aaae8fa04d148f665d7c61c6f7ac1f1a23e87994b7bc6b0ba7fdd2fd0fa2d4575ac460195
SSDEEP

196608:uchhf7FHaM6MkwG2ea8oQoidqpcO49UEahKBXSmLnS0rCqs2vm9EGgy:dvfBdPG2QzoY1OgUEPV7r9s2+9bgy

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1162710207558852689/c241__Tv-C5fSE0jsivUVIhYUTy9AQG_2q-Wedc4i61WcTidBFF8dAoQzbri3Cz5u5KI

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Executes dropped EXE 1 IoCs

Processes:

RP.EXE

pid process

2908 RP.EXE
Loads dropped DLL 5 IoCs

Processes:

RP.sfx.exe

pid process

2448 RP.sfx.exe
2448 RP.sfx.exe
2448 RP.sfx.exe
2448 RP.sfx.exe
2448 RP.sfx.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 freegeoip.app
5 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2908	RP.EXE

pid	process
2448	RP.sfx.exe
2448	RP.sfx.exe
2448	RP.sfx.exe
2448	RP.sfx.exe
2448	RP.sfx.exe

flow	ioc
4	freegeoip.app
5	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RP.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RP.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RP.EXE

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\7Z_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.7Z	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.7Z\ = "7Z_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\7Z_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\7Z_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\7Z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\7Z_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\7Z_auto_file\shell\Read	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

RP.EXE

pid process

2908 RP.EXE
2908 RP.EXE
2908 RP.EXE
2908 RP.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1512 AcroRd32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RP.EXE

description pid process

Token: SeDebugPrivilege 2908 RP.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1512 AcroRd32.exe
1512 AcroRd32.exe
1512 AcroRd32.exe

pid	process
2908	RP.EXE
2908	RP.EXE
2908	RP.EXE
2908	RP.EXE

pid	process
1512	AcroRd32.exe

description	pid	process
Token: SeDebugPrivilege	2908	RP.EXE

pid	process
1512	AcroRd32.exe
1512	AcroRd32.exe
1512	AcroRd32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

RP.sfx.exerundll32.exe

description	pid	process	target process
PID 2448 wrote to memory of 2908	2448	RP.sfx.exe	RP.EXE
PID 2448 wrote to memory of 2908	2448	RP.sfx.exe	RP.EXE
PID 2448 wrote to memory of 2908	2448	RP.sfx.exe	RP.EXE
PID 2448 wrote to memory of 2908	2448	RP.sfx.exe	RP.EXE
PID 2448 wrote to memory of 2776	2448	RP.sfx.exe	rundll32.exe
PID 2448 wrote to memory of 2776	2448	RP.sfx.exe	rundll32.exe
PID 2448 wrote to memory of 2776	2448	RP.sfx.exe	rundll32.exe
PID 2448 wrote to memory of 2776	2448	RP.sfx.exe	rundll32.exe
PID 2448 wrote to memory of 2776	2448	RP.sfx.exe	rundll32.exe
PID 2448 wrote to memory of 2776	2448	RP.sfx.exe	rundll32.exe
PID 2448 wrote to memory of 2776	2448	RP.sfx.exe	rundll32.exe
PID 2776 wrote to memory of 1512	2776	rundll32.exe	AcroRd32.exe
PID 2776 wrote to memory of 1512	2776	rundll32.exe	AcroRd32.exe
PID 2776 wrote to memory of 1512	2776	rundll32.exe	AcroRd32.exe
PID 2776 wrote to memory of 1512	2776	rundll32.exe	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\RP.sfx.exe
"C:\Users\Admin\AppData\Local\Temp\RP.sfx.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448

C:\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.EXE
"C:\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.EXE"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.7Z
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2776

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.7z"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt
Filesize
399B

MD5
fd42b4baf19100cadab1cdf21bd4ad84

SHA1
178a58548945037a89f26413d7c08bac2688569e

SHA256
c1bbfe11cdd1330db3a6da77339893e3e3c0887441831c7543a5c7eb399d707d

SHA512
010ced6bf7e6db5c953e60aae61af2f72725e0d6eb4f2f572d511bbecfe23bc508113aa59ec047e8f681f77902ce1479775e760bef24edc765a2b8f21b8141c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.7z
Filesize
9.6MB

MD5
74a50da81611d6a2eef2d5e458c7fffa

SHA1
13065fdbe2ca38c8894f748f073da3fa70a28e4d

SHA256
fe244979a074656d0143fa473a2dc0372ed736507dc7df0bcae2782fd05a26c7

SHA512
80bc90e626f1902b9853d6d4698b496574f2bf13095f1d8d745ded7949a048fe34c65fae8d22628037d2e82386859b587a32376b3d8892eaf3c7796200087c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.EXE
Filesize
251KB

MD5
513286e3e241f1c93556f45db4f8dc23

SHA1
32c83261b6ac5663e91664764aab429e6cd424d1

SHA256
a46070cb169ed0754c0fb624ad29f59fbc66fb75df9d2b3daefda76bc0d0d893

SHA512
890a2d7a72cf9975ebd716ad3c6f05f595afd1218106054c3c33ff1b9d41baf52c0013b8f65d975d372151b3303311f6554cb412fbcbbb0cf01dc8e81109f693

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.exe
Filesize
251KB

MD5
513286e3e241f1c93556f45db4f8dc23

SHA1
32c83261b6ac5663e91664764aab429e6cd424d1

SHA256
a46070cb169ed0754c0fb624ad29f59fbc66fb75df9d2b3daefda76bc0d0d893

SHA512
890a2d7a72cf9975ebd716ad3c6f05f595afd1218106054c3c33ff1b9d41baf52c0013b8f65d975d372151b3303311f6554cb412fbcbbb0cf01dc8e81109f693

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.exe
Filesize
251KB

MD5
513286e3e241f1c93556f45db4f8dc23

SHA1
32c83261b6ac5663e91664764aab429e6cd424d1

SHA256
a46070cb169ed0754c0fb624ad29f59fbc66fb75df9d2b3daefda76bc0d0d893

SHA512
890a2d7a72cf9975ebd716ad3c6f05f595afd1218106054c3c33ff1b9d41baf52c0013b8f65d975d372151b3303311f6554cb412fbcbbb0cf01dc8e81109f693

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
582aa3897e53095ced7e47ad8a5f61c4

SHA1
ad8c761f911b6f0c21da6f68d3979d1c543560ee

SHA256
fa138c9ac57559ff51aae91460de2f925a608f62d01a7c4317cb6c1b53ccddbd

SHA512
7953bfb9a0c6a2da08bb9ca2424aa52e9e5adf45467065f4e5f8050e99c842aeb664e6b153f0b0f1562c76c92de682286afb3f2b35fdb6b7af02820c4c8e7038

Download Submit
\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.exe
Filesize
251KB

MD5
513286e3e241f1c93556f45db4f8dc23

SHA1
32c83261b6ac5663e91664764aab429e6cd424d1

SHA256
a46070cb169ed0754c0fb624ad29f59fbc66fb75df9d2b3daefda76bc0d0d893

SHA512
890a2d7a72cf9975ebd716ad3c6f05f595afd1218106054c3c33ff1b9d41baf52c0013b8f65d975d372151b3303311f6554cb412fbcbbb0cf01dc8e81109f693

Download Submit
\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.exe
Filesize
251KB

MD5
513286e3e241f1c93556f45db4f8dc23

SHA1
32c83261b6ac5663e91664764aab429e6cd424d1

SHA256
a46070cb169ed0754c0fb624ad29f59fbc66fb75df9d2b3daefda76bc0d0d893

SHA512
890a2d7a72cf9975ebd716ad3c6f05f595afd1218106054c3c33ff1b9d41baf52c0013b8f65d975d372151b3303311f6554cb412fbcbbb0cf01dc8e81109f693

Download Submit
\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.exe
Filesize
251KB

MD5
513286e3e241f1c93556f45db4f8dc23

SHA1
32c83261b6ac5663e91664764aab429e6cd424d1

SHA256
a46070cb169ed0754c0fb624ad29f59fbc66fb75df9d2b3daefda76bc0d0d893

SHA512
890a2d7a72cf9975ebd716ad3c6f05f595afd1218106054c3c33ff1b9d41baf52c0013b8f65d975d372151b3303311f6554cb412fbcbbb0cf01dc8e81109f693

Download Submit
\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.exe
Filesize
251KB

MD5
513286e3e241f1c93556f45db4f8dc23

SHA1
32c83261b6ac5663e91664764aab429e6cd424d1

SHA256
a46070cb169ed0754c0fb624ad29f59fbc66fb75df9d2b3daefda76bc0d0d893

SHA512
890a2d7a72cf9975ebd716ad3c6f05f595afd1218106054c3c33ff1b9d41baf52c0013b8f65d975d372151b3303311f6554cb412fbcbbb0cf01dc8e81109f693

Download Submit
\Users\Admin\AppData\Local\Temp\RESOURCEPACK\RP.exe
Filesize
251KB

MD5
513286e3e241f1c93556f45db4f8dc23

SHA1
32c83261b6ac5663e91664764aab429e6cd424d1

SHA256
a46070cb169ed0754c0fb624ad29f59fbc66fb75df9d2b3daefda76bc0d0d893

SHA512
890a2d7a72cf9975ebd716ad3c6f05f595afd1218106054c3c33ff1b9d41baf52c0013b8f65d975d372151b3303311f6554cb412fbcbbb0cf01dc8e81109f693

Download Submit
memory/2908-20-0x0000000000CA0000-0x0000000000CE6000-memory.dmp

Filesize
280KB

Download
memory/2908-21-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

Filesize
9.9MB

Download
memory/2908-22-0x0000000002110000-0x0000000002190000-memory.dmp

Filesize
512KB

Download
memory/2908-72-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

Filesize
9.9MB

Download