Analysis
-
max time kernel
159s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-12-2023 15:03
General
-
Target
02c9b93a30cac707fcf002a0de796ffa.exe
-
Size
2.2MB
-
MD5
02c9b93a30cac707fcf002a0de796ffa
-
SHA1
bfdc0777ef4d84a248045919fae0e2fc9ba33952
-
SHA256
d580e3cc2480f082f140cc784c0249f19d0c412d7758fb97ba8e750441188bb6
-
SHA512
05fde0d4e1afbc0e5d3d7315fee4016caf5a5ed8f2365062cbb8588fb7552d8fd999a82e8f2360336b77bd0ffc9eb39c62aca5992e709f781f80e64bf561feb7
-
SSDEEP
49152:QwoR6eo4uwBM3RlNpDE15UR43WNKrAdlK4MI0Q:qNokMBlLDE1W+uuAIJ
Malware Config
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02c9b93a30cac707fcf002a0de796ffa.exe"C:\Users\Admin\AppData\Local\Temp\02c9b93a30cac707fcf002a0de796ffa.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52649f5649e94475ae9420f3e6ef7caf7
SHA1eb79a5c84a9e484c211c45a4db739259e2256839
SHA256fd9a7f21946cd564db04d491bac8a6f8b5947fefed9b6c0506d65b24f791c974
SHA51246a80e99b7c149c4d75d94af65014a96310700f45b42ae23620f791ac015cfc0997008addac7c3ff5a92241f7c4fe76589ffba6fd6d5cb160641cf6f0fb6c5e7
-
Filesize
411B
MD5e09d4e40677868caa2f3e6d6b8a4548b
SHA1981a2a160b2ef91fd9bac8a3b366210e95755fc1
SHA256572ca26b4e0b80b05a31509896905a0fffd90010496fbded7aff0a4375c444a7
SHA5129974bb5e8afce78eae4e5f394f40b4e75d12b3fecb98e358e582b7566f85c917d27793b6e96310ef7b2f1c3b6f3874ad16f7c4fa4775a9082bcc50ad7ad1b98c
-
Filesize
885B
MD56c9e6cfc2bd39862205b82281ddb46c2
SHA19c2d6e30f1fe8ac0f877ae2e089bbbf8ab627ddc
SHA256afb9f7f9c1e3725b8b850cbc2e20970be9b7644291383d888355a6458216f9d2
SHA512794037f4617fafb5eabc5f926106bae8287aaba5d23e0e5d409f6e79650dd4d4e7ca5f35d4d810c99a881490c9f0dcf306776938b2722e8a8778543a9b05f99d
-
Filesize
900B
MD5e47726ef6527eb9f17f9a5f742a2477f
SHA18ed0a78f8cbf30d3ab22d94ebe453b0f08197294
SHA256fb481877e7979c65197df03595e1ae8a546703665718a37c0afeb6d21001af55
SHA512b60bf11a64914dcfe76b30d88aba11ead50c615704734c447e608dccf2dff20fd59dfa592fed89f8c38da66b153d6d511e189666f3af24c88ced6c1b46c9445c
-
Filesize
2.2MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB