Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19-12-2023 17:21
General
-
Target
68d35e54dfeed830ec119b78f61af992.exe
-
Size
4.3MB
-
MD5
68d35e54dfeed830ec119b78f61af992
-
SHA1
49baa8c0081ae25e05fa9f6d27f4e84c4773a77a
-
SHA256
f0a1ec7d501bcdb83c63b84d3ec1fd7ffb90e78a31ffeda9182c34e1d7eee543
-
SHA512
c7e41b7095c47b23a380cbb9da3d2513102f2081cb4a1ae5d87aba5866005286f90f01d04ad1ca8986a743623c72aa87378c06c505057c5bbf77ba0549977d8c
-
SSDEEP
98304:a7YLLWh9a/w4MeWSuoQyK5G+SwSXJezFasO8lBJ3FRsFR:a7YWhsIrSuuIG+EZE/lBJ3O
Malware Config
Extracted
44caliber
https://discordapp.com/api/webhooks/893128410019278858/tGGLgbbsDNDE6jU3LWQhmeL1LvsML2n__m8nmjbo9A045JghDyW6wHwGbWb3FIuxh5Fb
Signatures
-
44Caliber
An open source infostealer written in C#.
-
BlackGuard
Infostealer first seen in Late 2021.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68d35e54dfeed830ec119b78f61af992.exe"C:\Users\Admin\AppData\Local\Temp\68d35e54dfeed830ec119b78f61af992.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
1KB
MD577d36bea770587cad302d521a8b38165
SHA1edfe416b6ca157ddd71e7ad7133f54749c674a8c
SHA256bf3050fe8800426e522c6843e8d819fc65ec07bfd09e64e895dd2f12f4250827
SHA5122f8fd3917d55929bdee6092d6e7221cdc74a0a7f494de18a86336fc10d3ea7071522f8685f5ac3555144d4e1f24f10e7a45c72802604958b092089deec673771
-
Filesize
1KB
MD5de70117382c0cd0bd179685ae1453d64
SHA1d473fc677f03bae5baf2d3bbc437375f5ac0824f
SHA256d75969dee83b6a77d8feb092ecc4ed07493cc012d86edf403b1b37edae815f85
SHA512409931d8e0b55817c88e76bde7f71dadaab7b5d0dc51307ab9a10d27e6fc11bd6952d89cc739b14323042da4b0ca205fc082db965c094c7fed78a5767bf1c668
-
Filesize
1KB
MD5032a5f671c1521f42e71ba6dc2d01902
SHA153b5dc9119f4b5187b937b341b8e79833fed3447
SHA25682ffad501cfbb1554f0cdb73646bd616ef79a76f8d0d3c3c394811a34330a27a
SHA512df5ac7db8cbe95ac99932555125dacbb89a7ae7b4360505369fc1d8b606b7fa2ab0ae27eb1ffc1a28feb22e32e77df986064faf56e9b5d4aec8e17adb8a5122d
-
Filesize
960KB
-
Filesize
5.6MB
-
Filesize
960KB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
584KB
-
Filesize
11.9MB
-
Filesize
8KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
408KB
-
Filesize
11.9MB
-
Filesize
960KB