Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28-12-2023 12:38
General
-
Target
df1c3a1b70fc8f37ea642c4df3a2f66b.exe
-
Size
448KB
-
MD5
df1c3a1b70fc8f37ea642c4df3a2f66b
-
SHA1
87b9d4bacc776489efb68f762913b76ef86908bf
-
SHA256
51cfc971849b6d809df4f567616db7f420874a754752490b981134f1d40ff47c
-
SHA512
a5a3e83d48f6eb0bd1ccbd4f48567c04d66ec1ba11b4afaf55df5f120b186ad3c764dd78b9835f8b2fb37b0d76d3f77ec08657f355c6734960359017e00fb512
-
SSDEEP
6144:+efG+g1L+8z7eoRDemTD+uf9+GV6eauyGFyInlXYWbgqtS4zbvhdaDz/A7Ah5lL2:+3S8xTiG04nTbcAcDq
Malware Config
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df1c3a1b70fc8f37ea642c4df3a2f66b.exe"C:\Users\Admin\AppData\Local\Temp\df1c3a1b70fc8f37ea642c4df3a2f66b.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e15efa0cb0d30f5d2a49cc0b7dac8a44
SHA1894b115ada199c6d8a4a05f7933b3dfcd8fba96c
SHA256040ea91680cbf360fe3d073772594976d486a35c98d392c619c46e2895fb7112
SHA512519e4c191a1f2f039de35150bd4c7d5d6fe724def8628705767e37f1724028e61cdd5c4a738aada07b338f2556c817dda68ec09932b2bcfe1ca7f05edc4bad39
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB