Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 13:37

General

  • Target

    224e8b219e855f118375d487e6ac15f0.exe

  • Size

    252KB

  • MD5

    224e8b219e855f118375d487e6ac15f0

  • SHA1

    02397f0e277508ce202d7f90b325c4ed7298eeb4

  • SHA256

    80d0de1de27f659bdc31d0aab393837167b348ff4029e354be394fb2b79ba371

  • SHA512

    c03b4714973936f93032e6cf5b50b12637c9a9d562221b9887b4f34c717ee03e49824dc1a2fe33d7b03c495255ab7ccb05c623807680230e8534d3cf6f1c7d4f

  • SSDEEP

    3072:nI7+8kQQHL+ueDVpsXMpI9B0p3DvsR2P4COdP0V9y40z4Ekz1eaMjAmectmqy3hb:4+8MHMt+9B0lvq2P4Lm9y1k1z1eRbpd

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/869635461541429258/hxEYazB2m_bqWOWdlnRrBOnLi8waabSchbnYiXPHDudSBlAEOry51hz3i902VgDh1LGm

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\224e8b219e855f118375d487e6ac15f0.exe
    "C:\Users\Admin\AppData\Local\Temp\224e8b219e855f118375d487e6ac15f0.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    397B

    MD5

    2daea40623631141a6395758ae9dd700

    SHA1

    87ed4cb70371c03c8b2536c9f57c163c6a9d7e56

    SHA256

    aa460271ffd07c0993c8bc00078966526e2c18bf53b5096e1c48acffd0bc9c85

    SHA512

    de822f072aac4436acf18ec3f62134ea3514a1ba428c3ce0a1ac0ff8de17c0a7bfe9cb1e8f34f7f9ff1037c0b2566d45150e268c5354b792d7fe75e0e8d74e2e

  • memory/2956-0-0x0000000000DF0000-0x0000000000E36000-memory.dmp

    Filesize

    280KB

  • memory/2956-1-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

    Filesize

    9.9MB

  • memory/2956-2-0x000000001B2E0000-0x000000001B360000-memory.dmp

    Filesize

    512KB

  • memory/2956-49-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

    Filesize

    9.9MB