44caliber | f0a1ec7d501bcdb83c63b84d3ec1fd7ffb90e78a31ffeda9182c34e1d7eee543

General

Target

68d35e54dfeed830ec119b78f61af992.exe
Size

4.3MB
MD5

68d35e54dfeed830ec119b78f61af992
SHA1

49baa8c0081ae25e05fa9f6d27f4e84c4773a77a
SHA256

f0a1ec7d501bcdb83c63b84d3ec1fd7ffb90e78a31ffeda9182c34e1d7eee543
SHA512

c7e41b7095c47b23a380cbb9da3d2513102f2081cb4a1ae5d87aba5866005286f90f01d04ad1ca8986a743623c72aa87378c06c505057c5bbf77ba0549977d8c
SSDEEP

98304:a7YLLWh9a/w4MeWSuoQyK5G+SwSXJezFasO8lBJ3FRsFR:a7YWhsIrSuuIG+EZE/lBJ3O

Score

10^/10

44caliber blackguard evasion spyware stealer themida trojan

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/893128410019278858/tGGLgbbsDNDE6jU3LWQhmeL1LvsML2n__m8nmjbo9A045JghDyW6wHwGbWb3FIuxh5Fb

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

68d35e54dfeed830ec119b78f61af992.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 68d35e54dfeed830ec119b78f61af992.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	68d35e54dfeed830ec119b78f61af992.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

68d35e54dfeed830ec119b78f61af992.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	68d35e54dfeed830ec119b78f61af992.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	68d35e54dfeed830ec119b78f61af992.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/5032-10-0x00000000000F0000-0x0000000000CE0000-memory.dmp	themida
behavioral2/memory/5032-11-0x00000000000F0000-0x0000000000CE0000-memory.dmp	themida
behavioral2/memory/5032-141-0x00000000000F0000-0x0000000000CE0000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

68d35e54dfeed830ec119b78f61af992.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	68d35e54dfeed830ec119b78f61af992.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 freegeoip.app
11 freegeoip.app
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

68d35e54dfeed830ec119b78f61af992.exe

pid process

5032 68d35e54dfeed830ec119b78f61af992.exe

flow	ioc
12	freegeoip.app
11	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

68d35e54dfeed830ec119b78f61af992.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	68d35e54dfeed830ec119b78f61af992.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	68d35e54dfeed830ec119b78f61af992.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

68d35e54dfeed830ec119b78f61af992.exe

pid	process
5032	68d35e54dfeed830ec119b78f61af992.exe
5032	68d35e54dfeed830ec119b78f61af992.exe
5032	68d35e54dfeed830ec119b78f61af992.exe
5032	68d35e54dfeed830ec119b78f61af992.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

68d35e54dfeed830ec119b78f61af992.exe

description pid process

Token: SeDebugPrivilege 5032 68d35e54dfeed830ec119b78f61af992.exe

description	pid	process
Token: SeDebugPrivilege	5032	68d35e54dfeed830ec119b78f61af992.exe

C:\Users\Admin\AppData\Local\Temp\68d35e54dfeed830ec119b78f61af992.exe
"C:\Users\Admin\AppData\Local\Temp\68d35e54dfeed830ec119b78f61af992.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5032

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
77d36bea770587cad302d521a8b38165

SHA1
edfe416b6ca157ddd71e7ad7133f54749c674a8c

SHA256
bf3050fe8800426e522c6843e8d819fc65ec07bfd09e64e895dd2f12f4250827

SHA512
2f8fd3917d55929bdee6092d6e7221cdc74a0a7f494de18a86336fc10d3ea7071522f8685f5ac3555144d4e1f24f10e7a45c72802604958b092089deec673771

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
de70117382c0cd0bd179685ae1453d64

SHA1
d473fc677f03bae5baf2d3bbc437375f5ac0824f

SHA256
d75969dee83b6a77d8feb092ecc4ed07493cc012d86edf403b1b37edae815f85

SHA512
409931d8e0b55817c88e76bde7f71dadaab7b5d0dc51307ab9a10d27e6fc11bd6952d89cc739b14323042da4b0ca205fc082db965c094c7fed78a5767bf1c668

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
032a5f671c1521f42e71ba6dc2d01902

SHA1
53b5dc9119f4b5187b937b341b8e79833fed3447

SHA256
82ffad501cfbb1554f0cdb73646bd616ef79a76f8d0d3c3c394811a34330a27a

SHA512
df5ac7db8cbe95ac99932555125dacbb89a7ae7b4360505369fc1d8b606b7fa2ab0ae27eb1ffc1a28feb22e32e77df986064faf56e9b5d4aec8e17adb8a5122d

Download Submit
memory/5032-4-0x00000000762B0000-0x00000000763A0000-memory.dmp

Filesize
960KB

Download
memory/5032-46-0x0000000006F60000-0x0000000007504000-memory.dmp

Filesize
5.6MB

Download
memory/5032-5-0x00000000762B0000-0x00000000763A0000-memory.dmp

Filesize
960KB

Download
memory/5032-10-0x00000000000F0000-0x0000000000CE0000-memory.dmp

Filesize
11.9MB

Download
memory/5032-11-0x00000000000F0000-0x0000000000CE0000-memory.dmp

Filesize
11.9MB

Download
memory/5032-12-0x00000000063D0000-0x0000000006462000-memory.dmp

Filesize
584KB

Download
memory/5032-0-0x00000000000F0000-0x0000000000CE0000-memory.dmp

Filesize
11.9MB

Download
memory/5032-6-0x0000000076FB4000-0x0000000076FB6000-memory.dmp

Filesize
8KB

Download
memory/5032-3-0x00000000762B0000-0x00000000763A0000-memory.dmp

Filesize
960KB

Download
memory/5032-2-0x00000000762B0000-0x00000000763A0000-memory.dmp

Filesize
960KB

Download
memory/5032-1-0x00000000762B0000-0x00000000763A0000-memory.dmp

Filesize
960KB

Download
memory/5032-137-0x0000000006E20000-0x0000000006E86000-memory.dmp

Filesize
408KB

Download
memory/5032-141-0x00000000000F0000-0x0000000000CE0000-memory.dmp

Filesize
11.9MB

Download
memory/5032-142-0x00000000762B0000-0x00000000763A0000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads