44caliber | d580e3cc2480f082f140cc784c0249f19d0c412d7758fb97ba8e750441188bb6

Analysis

max time kernel
159s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02c9b93a30cac707fcf002a0de796ffa.exe
Size

2.2MB
MD5

02c9b93a30cac707fcf002a0de796ffa
SHA1

bfdc0777ef4d84a248045919fae0e2fc9ba33952
SHA256

d580e3cc2480f082f140cc784c0249f19d0c412d7758fb97ba8e750441188bb6
SHA512

05fde0d4e1afbc0e5d3d7315fee4016caf5a5ed8f2365062cbb8588fb7552d8fd999a82e8f2360336b77bd0ffc9eb39c62aca5992e709f781f80e64bf561feb7
SSDEEP

49152:QwoR6eo4uwBM3RlNpDE15UR43WNKrAdlK4MI0Q:qNokMBlLDE1W+uuAIJ

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

25 freegeoip.app
27 freegeoip.app

flow	ioc
25	freegeoip.app
27	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

02c9b93a30cac707fcf002a0de796ffa.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	02c9b93a30cac707fcf002a0de796ffa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	02c9b93a30cac707fcf002a0de796ffa.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

02c9b93a30cac707fcf002a0de796ffa.exe

pid	process
3772	02c9b93a30cac707fcf002a0de796ffa.exe
3772	02c9b93a30cac707fcf002a0de796ffa.exe
3772	02c9b93a30cac707fcf002a0de796ffa.exe
3772	02c9b93a30cac707fcf002a0de796ffa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

02c9b93a30cac707fcf002a0de796ffa.exe

description pid process

Token: SeDebugPrivilege 3772 02c9b93a30cac707fcf002a0de796ffa.exe

description	pid	process
Token: SeDebugPrivilege	3772	02c9b93a30cac707fcf002a0de796ffa.exe

C:\Users\Admin\AppData\Local\Temp\02c9b93a30cac707fcf002a0de796ffa.exe
"C:\Users\Admin\AppData\Local\Temp\02c9b93a30cac707fcf002a0de796ffa.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt
Filesize
1KB

MD5
2649f5649e94475ae9420f3e6ef7caf7

SHA1
eb79a5c84a9e484c211c45a4db739259e2256839

SHA256
fd9a7f21946cd564db04d491bac8a6f8b5947fefed9b6c0506d65b24f791c974

SHA512
46a80e99b7c149c4d75d94af65014a96310700f45b42ae23620f791ac015cfc0997008addac7c3ff5a92241f7c4fe76589ffba6fd6d5cb160641cf6f0fb6c5e7

Download Submit
C:\ProgramData\44\Process.txt
Filesize
411B

MD5
e09d4e40677868caa2f3e6d6b8a4548b

SHA1
981a2a160b2ef91fd9bac8a3b366210e95755fc1

SHA256
572ca26b4e0b80b05a31509896905a0fffd90010496fbded7aff0a4375c444a7

SHA512
9974bb5e8afce78eae4e5f394f40b4e75d12b3fecb98e358e582b7566f85c917d27793b6e96310ef7b2f1c3b6f3874ad16f7c4fa4775a9082bcc50ad7ad1b98c

Download Submit
C:\ProgramData\44\Process.txt
Filesize
885B

MD5
6c9e6cfc2bd39862205b82281ddb46c2

SHA1
9c2d6e30f1fe8ac0f877ae2e089bbbf8ab627ddc

SHA256
afb9f7f9c1e3725b8b850cbc2e20970be9b7644291383d888355a6458216f9d2

SHA512
794037f4617fafb5eabc5f926106bae8287aaba5d23e0e5d409f6e79650dd4d4e7ca5f35d4d810c99a881490c9f0dcf306776938b2722e8a8778543a9b05f99d

Download Submit
C:\ProgramData\44\Process.txt
Filesize
900B

MD5
e47726ef6527eb9f17f9a5f742a2477f

SHA1
8ed0a78f8cbf30d3ab22d94ebe453b0f08197294

SHA256
fb481877e7979c65197df03595e1ae8a546703665718a37c0afeb6d21001af55

SHA512
b60bf11a64914dcfe76b30d88aba11ead50c615704734c447e608dccf2dff20fd59dfa592fed89f8c38da66b153d6d511e189666f3af24c88ced6c1b46c9445c

Download Submit
memory/3772-0-0x00000000005B0000-0x00000000007E0000-memory.dmp

Filesize
2.2MB

Download
memory/3772-30-0x00007FFD94720000-0x00007FFD951E1000-memory.dmp

Filesize
10.8MB

Download
memory/3772-31-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/3772-127-0x00007FFD94720000-0x00007FFD951E1000-memory.dmp

Filesize
10.8MB

Download