44caliber | 42f1065841dc77643d3a3c33fb40de4c2931e3a4d15d9802fff0a194c821ea2b

Analysis

max time kernel
21s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebc6d55a45996861c5a84937d2a990da.exe
Size

275KB
MD5

ebc6d55a45996861c5a84937d2a990da
SHA1

db9e42e191c95168d03274cc4d0ab18e35d3f314
SHA256

42f1065841dc77643d3a3c33fb40de4c2931e3a4d15d9802fff0a194c821ea2b
SHA512

927560123afb2d46c4a57065402182bf5522bc3be9d4d9593ec79d72eb4fdd12edc85dbe77d24e2801550bf1c09ac950521b52a62c384de2aad2304edf8db477
SSDEEP

6144:Wf+BLtABPD9FBWKXsSlrVPl/9rHxlqQy8ERA190AxR:sFsSlrVPlJxlNyW19vR

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/869968115126128690/9HuocC8P0OFpxwEHR7UGW0ZtseqV8b95oQ9ExN0rHkwTjipAQLrkOqPzDiDXxXky3kUL

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 freegeoip.app
4 freegeoip.app

flow	ioc
11	freegeoip.app
4	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ebc6d55a45996861c5a84937d2a990da.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	ebc6d55a45996861c5a84937d2a990da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ebc6d55a45996861c5a84937d2a990da.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ebc6d55a45996861c5a84937d2a990da.exe

pid	process
1924	ebc6d55a45996861c5a84937d2a990da.exe
1924	ebc6d55a45996861c5a84937d2a990da.exe
1924	ebc6d55a45996861c5a84937d2a990da.exe
1924	ebc6d55a45996861c5a84937d2a990da.exe
1924	ebc6d55a45996861c5a84937d2a990da.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ebc6d55a45996861c5a84937d2a990da.exe

description pid process

Token: SeDebugPrivilege 1924 ebc6d55a45996861c5a84937d2a990da.exe

description	pid	process
Token: SeDebugPrivilege	1924	ebc6d55a45996861c5a84937d2a990da.exe

C:\Users\Admin\AppData\Local\Temp\ebc6d55a45996861c5a84937d2a990da.exe
"C:\Users\Admin\AppData\Local\Temp\ebc6d55a45996861c5a84937d2a990da.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
214B

MD5
ae738d948644634cc644bb72b2d34fb8

SHA1
8c35f3a7d133dca6833e292cfd395fcdd1d26da6

SHA256
b3ebb9d6dba586cc0d46fcb610d6a278835678d78f31730e3a0a4d98d4c95167

SHA512
31c14e384bcc70c6dfcec4bc46e888beb0b448ada6629c9893728afd9a20ed81e1da7d82decf89ff783937941b210c337934f4f273561367606b73e8d41a9893

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
632B

MD5
fa1c5a3a9aa922e85a77d8513a495ed4

SHA1
ce3b5f9dc28b74a4a66fb14e6e5e388c2d6b0aee

SHA256
f8afb012d26eefe7c5f701dd6ce8cde9c5f1d92992243db7965173a109ba70da

SHA512
f86aa6c5c1354fad9c38eaa07f7598ee8672f956cf27c0ed1551c04c8f5b6bf03bc6603e975b76f240d40425f6257bb531be9d5f634485d80d3b41958a93a036

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
996B

MD5
0a0f182fcb49c6b8b8a505498d2dab5d

SHA1
b0f43a803a573f92929f7320a4fece5dac74f459

SHA256
3e78111e622108cada313af3ec0feaf787ef13e9c16da2bffcba01129ae3fbc9

SHA512
cf6912c5dff5c1670d37cd98059a2f01ff42f5a533cc803b9f3c982bdcece2ed985f92afa3d51a00a589ce93173ac89ad2764e42136510e243269290c283da8d

Download Submit
memory/1924-0-0x0000000000980000-0x00000000009CC000-memory.dmp

Filesize
304KB

Download
memory/1924-22-0x00007FFDAC0B0000-0x00007FFDACB71000-memory.dmp

Filesize
10.8MB

Download
memory/1924-31-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

Filesize
64KB

Download
memory/1924-32-0x00007FFDAC0B0000-0x00007FFDACB71000-memory.dmp

Filesize
10.8MB

Download
memory/1924-130-0x00007FFDAC0B0000-0x00007FFDACB71000-memory.dmp

Filesize
10.8MB

Download