Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
05-12-2023 06:52
General
-
Target
640d2a93bfc8e562453b35303ae4ec3c40c0de5b67eef3c28b1d1d498fa40f83.exe
-
Size
274KB
-
MD5
d6ae2f2cb1539dea4bb4d9ea9d5d5cce
-
SHA1
bc2ac2bc2d1ee035b65dbd43a4c0d134c51a3eeb
-
SHA256
640d2a93bfc8e562453b35303ae4ec3c40c0de5b67eef3c28b1d1d498fa40f83
-
SHA512
59c2d4eafcf67f91ee31104cb04be363ffbfadbe5a9667c0849584e666dffd4529f5c7dfd16905d63f9e2fa310c820aec20de7455ec753a48ab538885ac10ebd
-
SSDEEP
6144:vf+BLtABPDMtBBfn1Y0gIoHOQpafTyElI1D0pEA:otVvgIoHOOp1DxA
Malware Config
Extracted
44caliber
https://discordapp.com/api/webhooks/1179802952609837118/VQL2SnbY3OQKym01HTNlPaUzF5_zZWpyG0uR_TQhE0OllmdOQS7zEdjJ2Yw63bcoH9rt
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\640d2a93bfc8e562453b35303ae4ec3c40c0de5b67eef3c28b1d1d498fa40f83.exe"C:\Users\Admin\AppData\Local\Temp\640d2a93bfc8e562453b35303ae4ec3c40c0de5b67eef3c28b1d1d498fa40f83.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
739B
MD527103b8b045a070349d7e62764691dcc
SHA1ebda22f17809af3b9e453cf919f09b9e00cf9a04
SHA256999a33c918eb7e0d73272a55f2730d3d3c9d47fd3bd4e64fb9f6abb6ea42b321
SHA512188ce67e76bc3bdc3e116456836b6d04086b8addf0d460adaaba0208d3e124f0e071ba0a600d29146b94bd1a8ea54536e9ac1646d1e385dbc84abb60ad4a8f29
-
Filesize
1KB
MD5e65086a2bc7003dede204b92105484b7
SHA13d9d29c0935e5fbf12dc8bcef32c74519c95c9d3
SHA2563cd02814ee1174df9af6185365484daa90b0de6f6cebba41c85ca11266de5874
SHA512cb351387e4f96216e3084d0a47a97d78813a90f6ace4df74420961cb635422f188f4156379a2568f8695568c217212c38fbd0290bb281700194b4d1641c35f06
-
Filesize
296KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB