Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 13:37
Behavioral task
behavioral1
Sample
224e8b219e855f118375d487e6ac15f0.exe
Resource
win7-20231215-en
General
-
Target
224e8b219e855f118375d487e6ac15f0.exe
-
Size
252KB
-
MD5
224e8b219e855f118375d487e6ac15f0
-
SHA1
02397f0e277508ce202d7f90b325c4ed7298eeb4
-
SHA256
80d0de1de27f659bdc31d0aab393837167b348ff4029e354be394fb2b79ba371
-
SHA512
c03b4714973936f93032e6cf5b50b12637c9a9d562221b9887b4f34c717ee03e49824dc1a2fe33d7b03c495255ab7ccb05c623807680230e8534d3cf6f1c7d4f
-
SSDEEP
3072:nI7+8kQQHL+ueDVpsXMpI9B0p3DvsR2P4COdP0V9y40z4Ekz1eaMjAmectmqy3hb:4+8MHMt+9B0lvq2P4Lm9y1k1z1eRbpd
Malware Config
Extracted
44caliber
https://discordapp.com/api/webhooks/869635461541429258/hxEYazB2m_bqWOWdlnRrBOnLi8waabSchbnYiXPHDudSBlAEOry51hz3i902VgDh1LGm
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 freegeoip.app 3 freegeoip.app -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 224e8b219e855f118375d487e6ac15f0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 224e8b219e855f118375d487e6ac15f0.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2956 224e8b219e855f118375d487e6ac15f0.exe 2956 224e8b219e855f118375d487e6ac15f0.exe 2956 224e8b219e855f118375d487e6ac15f0.exe 2956 224e8b219e855f118375d487e6ac15f0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2956 224e8b219e855f118375d487e6ac15f0.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
397B
MD52daea40623631141a6395758ae9dd700
SHA187ed4cb70371c03c8b2536c9f57c163c6a9d7e56
SHA256aa460271ffd07c0993c8bc00078966526e2c18bf53b5096e1c48acffd0bc9c85
SHA512de822f072aac4436acf18ec3f62134ea3514a1ba428c3ce0a1ac0ff8de17c0a7bfe9cb1e8f34f7f9ff1037c0b2566d45150e268c5354b792d7fe75e0e8d74e2e