Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24-12-2023 20:39
General
-
Target
117b28e18c3cdee58cee6f5b4c6b708b.exe
-
Size
1.2MB
-
MD5
117b28e18c3cdee58cee6f5b4c6b708b
-
SHA1
bf3f7cf88712b01a8123d3836bf19f25b17a70ec
-
SHA256
b356d0dfecf39874a2bbbe4cae33f580d91a8991860df23314f35950f574485c
-
SHA512
3a2331e1f7266a262e308eab726ee43127631c7348e7931186d13f54577abb1a18a92d6a6664dc69a9cbe9098914bd0e6173d1adc634a545b9c87b3bedd600ea
-
SSDEEP
24576:8Shu0Xd9baM1zjL0KfafjvjZLJNWttqmO96tY:8SL7VUfjJWttlO9IY
Malware Config
Extracted
44caliber
https://discordapp.com/api/webhooks/859014405580783637/J-rOLcLQORAp4rSIpre0H46Lhmzd8QK1hgRFNA4mqYSEz6dtJRq9HsK-id725NgqZTvK
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\117b28e18c3cdee58cee6f5b4c6b708b.exe"C:\Users\Admin\AppData\Local\Temp\117b28e18c3cdee58cee6f5b4c6b708b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD55dcd8f93250bf05c07605117a84e69dc
SHA10c5bce4ccffcab3929e8b6c0489f229479936972
SHA2560e2c1612bcf6bbbd473fb1d208296ddffadfe239e209c5bac966aad207854e83
SHA512d3a41bb4c4b61e25d27a586393a898b08c0d20021c136f934412c9079ead0037502f5e71fb2a5a921ad04e627c8c5f94ea50c588013fe09e648cf8ffd3b6cafb
-
Filesize
240B
MD5fd2ebd092a90f31e26820fc0d93246df
SHA1f892c49388291c420e6198728d7d568c53b73494
SHA25623753b6cd47875ff1511ddf48be69ec728fb0c47bf367589175885974a39e2b4
SHA512f39d69964972d37c4ee49504befb224c3a2a913b49cc302de35f0784935a67075fa11d1c4ee094542f8fa8f01eece794f9e3a05b5c925546485240cf5ffa00cb
-
Filesize
412B
MD57473baabd931434fdab8dc346af74da3
SHA17187596b2a7c5c50850238ec6688743182f95ad2
SHA25627c9926e9b00d732f00b596ff477bd0cee7d652a59b3ca7312a8369f85bcce0e
SHA5129ccf6caae9f92a9fecedc83eb35b41fe4b6b355023ac909486de87b53ab2268888c5e9d1f0cd9417c201926ec7246c3768e5e70457d7b2481967d535a54f04bb
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
3.7MB