44caliber | d17470457a84cb120cf0fde0c405ae82a954c39534368e2cb9c6798823c69fe3

Analysis

max time kernel
2s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bd2d0c64ce33ca5522c34a8927db8dd.exe
Size

274KB
MD5

6bd2d0c64ce33ca5522c34a8927db8dd
SHA1

370a93b652c6d566c5921d727e298adf9640aa87
SHA256

d17470457a84cb120cf0fde0c405ae82a954c39534368e2cb9c6798823c69fe3
SHA512

3275e4de111ff3da91b5c53c1d4124bf536f436c763b072f574d19f8f43c88e95d614915ebb73876d68086b3bc4eddc60fabd1e5ca428f56e3e37d922b3ff3f4
SSDEEP

6144:Mf+BLtABPD9NF/DVGK7zeNL+wN41V6GIeyXGRA1D0nmG:KNKK7zeNLXY69eyXL1DdG

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/882980614087794780/2EXTWMBoMH9DQog67zK2ten38diDtxtqRM8VZIXtVQBTQ1ytliHQMSQQ6ozPiihxhSIW

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 freegeoip.app
4 freegeoip.app

flow	ioc
3	freegeoip.app
4	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6bd2d0c64ce33ca5522c34a8927db8dd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	6bd2d0c64ce33ca5522c34a8927db8dd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	6bd2d0c64ce33ca5522c34a8927db8dd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6bd2d0c64ce33ca5522c34a8927db8dd.exe

pid	process
4404	6bd2d0c64ce33ca5522c34a8927db8dd.exe
4404	6bd2d0c64ce33ca5522c34a8927db8dd.exe
4404	6bd2d0c64ce33ca5522c34a8927db8dd.exe
4404	6bd2d0c64ce33ca5522c34a8927db8dd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6bd2d0c64ce33ca5522c34a8927db8dd.exe

description pid process

Token: SeDebugPrivilege 4404 6bd2d0c64ce33ca5522c34a8927db8dd.exe

description	pid	process
Token: SeDebugPrivilege	4404	6bd2d0c64ce33ca5522c34a8927db8dd.exe

C:\Users\Admin\AppData\Local\Temp\6bd2d0c64ce33ca5522c34a8927db8dd.exe
"C:\Users\Admin\AppData\Local\Temp\6bd2d0c64ce33ca5522c34a8927db8dd.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
b3264905f38044773241b55057fd03f6

SHA1
abba2a74d422500f9e92a2b712f8da71a703904a

SHA256
cb2522ef494e18138f4cf0e4b7ec3e91162bbe5a46a06cc22411269359edb713

SHA512
c6467fb11826aa704d53e8f7864bf06c98f282a523db3e4fa2a307b4e24fd5503da55a624b141d64aca3123e953ea486953c6c37a38bf08e3cc5ef9b116c3722

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
646B

MD5
33ba04d0d766bda9094961b559f9667d

SHA1
830a420aa5ec63f96b3c7ebf738471831e93a7eb

SHA256
238ac299b4f3cc50763a4827e1976eac3bd25c601364fbc2a6c9676318962b5a

SHA512
4ceb39b740bb42c8c7400193fce1599225bdad57a79ab31311e18cd12853531843315c64e4f5097174a327f43f1ff1238f13551a4a07291a82251f8a40a4dfdf

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
806B

MD5
e268066ba1d3d9d8d6376c7c5f8fe470

SHA1
eb238e85a23a604b3a08184971855eba52d69001

SHA256
ac326198ca79b1313dfc5d7cff36421f601397ac63aa5ea2e542c86bec2a6f3c

SHA512
2cf32a212d035d1c7d6efe905b1277e80f936677801caa55329cd56eb572d078b2c965aa193cecd31c78d12b33395356e9848b2329848fb17768aa364ffb478a

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
915B

MD5
3e978b69b1422bccb9bc7ef535ebb66e

SHA1
8c20dd2828ebe1c38f42b53561b9c22d155458f9

SHA256
2590ac6715155a8274d32059bd32e4270007a1a0a9b37075e6bf74a1183ff1c7

SHA512
e87c4579640d463ad90fd2fca86e829cb1e43c714da3cbf1c7a6e1059d29cead8dafa176cf93109bf44d24642afd3a099e68708378723691859e1979c6d0ddc7

Download Submit
memory/4404-0-0x0000000000BB0000-0x0000000000BFA000-memory.dmp

Filesize
296KB

Download
memory/4404-32-0x000000001B850000-0x000000001B860000-memory.dmp

Filesize
64KB

Download
memory/4404-29-0x00007FFB60B90000-0x00007FFB61651000-memory.dmp

Filesize
10.8MB

Download
memory/4404-124-0x00007FFB60B90000-0x00007FFB61651000-memory.dmp

Filesize
10.8MB

Download