Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26-12-2023 22:04
General
-
Target
9197890c445e386627b5aecbdb522110.exe
-
Size
601KB
-
MD5
9197890c445e386627b5aecbdb522110
-
SHA1
5b3fcd7d1a7e2b1afef04e8d3983a14632c3260e
-
SHA256
206b5291a89b6a58d48c26bfbc954e793eba213823a2b00d69abd589cc189f02
-
SHA512
c78620ee44a67043f218af3bb2df6edecc8304a7d52a9ca933407d71bb6c858c7eb9eb9219488d1dde8414316dcf9a554e37a391765fb9b27b49726594bae132
-
SSDEEP
12288:x30MeC3c0J1e3IWxxukZFksJlT752pdfUjYSqI2yQfxLrHJT8EnEcouEfRG:x30MeCM+q8QFkiK7I2ZpLrH
Malware Config
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9197890c445e386627b5aecbdb522110.exe"C:\Users\Admin\AppData\Local\Temp\9197890c445e386627b5aecbdb522110.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53e6ad480f30ec75dbbdfae55cd4efc67
SHA1b0d0b51c1edb5b48eede8cdd80942a8a2ac8aad8
SHA2561006eae7605e20afca78bd124ad10259efef575450ff7c0f4031933d636db4e1
SHA51239b7487ebe80f4a1298eb07b33124125d3a5a157975c8e33a534eb2df5e33a3e760dfeb58c375e62f3ff9e06cb64916074566e200629b7c005be7dd252e37bbb
-
Filesize
1KB
MD5f5486bf14162ad77961d6940bb8bc2c0
SHA1cf7ea97a7e4dc6ce970fca6caf7b5f0d9167007f
SHA256eb6b89e66f48e17766d346c1b806057b9fece93685f2680fab66b366c5dc2ffa
SHA5129cfcab5b69b7d0225fcfff85f5b968839c466b1af8f1f87344446ef18400e5b68306645e3b1245bd079355aec694fbe739418dc3f91a13da0bbdffa608bb731b
-
Filesize
207B
MD55b03285dc54bdb79f62b57a9370130d5
SHA1f5878ed26e42960cfc77400ff0b023f1900ad936
SHA256cba3495dcfbf523fe6e55cb0dd7554f4c85a6d1d60845f6d9b601ca4d862aeba
SHA512ffd0a7097dfe6d33fa87deb11f7cdbb0214b9128b267179ec022d21704dd10999222784e7276f8fe814d0f8f65714bce502683a37186df24bf2dda7b05002ca9
-
Filesize
502B
MD5c90f0051f81872c39c9dc3a8623f6878
SHA161a9ede860770589619bf502d24995f7a3a2fc42
SHA2568c82468edfe9707bcad7c93399b643facefd9aaf1749e35d660bbd99792e2575
SHA51257904fbd16df69ba1410c078dea84c7f5c74b587edba49d9dd9e115a9956ef535017aa3cecbb26351160911856ff4ab85e3b90ef7e930f46abc98e5540aebe7c
-
Filesize
640KB
-
Filesize
10.8MB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
880KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
10.8MB