44caliber | 3ef9b22bb2941ee55af25105b87c675ef1bf6acf8928b339e36e5da08958e852

General

Target

063adc7edd5785637dff0fe0a606c36b.exe
Size

1.7MB
MD5

063adc7edd5785637dff0fe0a606c36b
SHA1

c2a4fd1c096fbe9cc4347a470355848f597f3af7
SHA256

3ef9b22bb2941ee55af25105b87c675ef1bf6acf8928b339e36e5da08958e852
SHA512

c011c9a11f4dd86ca706a6fae86cc89331b4b6747c29330a79b2c513ac2c5d68dffe0160b8c67e68c4c102002414a7a4675fe2315e3470461fcd889c319b631a
SSDEEP

49152:rFIAvAzZmo08b9N0qmI6pMH6UHP916LSfbqki67bFrp:5IAYzxVb9NR16pMHbHP916aql

Score

10^/10

44caliber blackguard spyware stealer

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1932930596:AAGkiZTh1w6VZfvuopWYz6JzBbBOSRI3Ja4/sendMessage?chat_id=1089147415

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 freegeoip.app
21 freegeoip.app

flow	ioc
20	freegeoip.app
21	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

063adc7edd5785637dff0fe0a606c36b.exe

pid	process
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

063adc7edd5785637dff0fe0a606c36b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	063adc7edd5785637dff0fe0a606c36b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	063adc7edd5785637dff0fe0a606c36b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

063adc7edd5785637dff0fe0a606c36b.exe

pid	process
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe
1396	063adc7edd5785637dff0fe0a606c36b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

063adc7edd5785637dff0fe0a606c36b.exe

description pid process

Token: SeDebugPrivilege 1396 063adc7edd5785637dff0fe0a606c36b.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

063adc7edd5785637dff0fe0a606c36b.exe

pid process

1396 063adc7edd5785637dff0fe0a606c36b.exe

description	pid	process
Token: SeDebugPrivilege	1396	063adc7edd5785637dff0fe0a606c36b.exe

C:\Users\Admin\AppData\Local\Temp\063adc7edd5785637dff0fe0a606c36b.exe
"C:\Users\Admin\AppData\Local\Temp\063adc7edd5785637dff0fe0a606c36b.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
532B

MD5
5c014d85da30853f8dc380c1495484e8

SHA1
9755cc75080681a6e922bba19424e8339ba1896d

SHA256
f7ad580488eb9da5940814738650df3e2dc58f9d0b01b33b22c862d2536402b1

SHA512
99ceec1b2a3903def120ef33a6b61e45e91589c9ce6ac661ad7f1705344a14f706f3eb219f761d6efa0464ae1c48737bc0f76cde758fadaaa18cc4bd5c7c5f3a

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
febca8af5db31865e55cb480d0c9a424

SHA1
463971ee77dac2cc8510487851ec489849e1d4f1

SHA256
495fc1fbd0df405c940b0e220095a4966131f837b0214d47249247abefe9f70a

SHA512
b5e9f268e85f887c9a0aa6f860bf10fb57d034f94438c90e946382ca80f7b39c94a56927c4cf5079f140a57db629f1d9a844cd2150ce2174fa0b5b614304cff7

Download Submit
memory/1396-157-0x0000000006100000-0x0000000006108000-memory.dmp

Filesize
32KB

Download
memory/1396-132-0x0000000006EF0000-0x0000000006F56000-memory.dmp

Filesize
408KB

Download
memory/1396-40-0x00000000069C0000-0x0000000006A52000-memory.dmp

Filesize
584KB

Download
memory/1396-41-0x0000000007010000-0x00000000075B4000-memory.dmp

Filesize
5.6MB

Download
memory/1396-3-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/1396-0-0x0000000000730000-0x0000000000C12000-memory.dmp

Filesize
4.9MB

Download
memory/1396-2-0x0000000074750000-0x0000000074F00000-memory.dmp

Filesize
7.7MB

Download
memory/1396-156-0x00000000060F0000-0x00000000060FA000-memory.dmp

Filesize
40KB

Download
memory/1396-1-0x0000000000730000-0x0000000000C12000-memory.dmp

Filesize
4.9MB

Download
memory/1396-158-0x0000000006E90000-0x0000000006EB2000-memory.dmp

Filesize
136KB

Download
memory/1396-159-0x0000000007940000-0x0000000007C94000-memory.dmp

Filesize
3.3MB

Download
memory/1396-162-0x0000000000730000-0x0000000000C12000-memory.dmp

Filesize
4.9MB

Download
memory/1396-163-0x0000000074750000-0x0000000074F00000-memory.dmp

Filesize
7.7MB

Download
memory/1396-164-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/1396-176-0x0000000000730000-0x0000000000C12000-memory.dmp

Filesize
4.9MB

Download
memory/1396-177-0x0000000074750000-0x0000000074F00000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads