44caliber | e85e95fb39da06e23c5a3826863cd7e8092303c7dc2f033782077acb72fc7f75

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cf2dcd52ddaba73e7ee554ef42c4328.exe
Size

599KB
MD5

0cf2dcd52ddaba73e7ee554ef42c4328
SHA1

927011a0a7f2e6cacfa671e9833b80ad27f75cfb
SHA256

e85e95fb39da06e23c5a3826863cd7e8092303c7dc2f033782077acb72fc7f75
SHA512

e8938d32c579b340465cfbd3c58cc76780e710678aa93d5281cfbfc9986b9d839417b08ce726c1893979140abc937bf736269835e7ac46958cf6bdf2cdf5a168
SSDEEP

12288:XGGD7aY51GkWnntfPMoZNWY44Z2GzLAF2mtxryrlv1QD3EIqD:XGGD7JjGnntftZND44Z2hF2Wyl

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 freegeoip.app
11 freegeoip.app

flow	ioc
6	freegeoip.app
11	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0cf2dcd52ddaba73e7ee554ef42c4328.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	0cf2dcd52ddaba73e7ee554ef42c4328.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	0cf2dcd52ddaba73e7ee554ef42c4328.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0cf2dcd52ddaba73e7ee554ef42c4328.exe

pid	process
3896	0cf2dcd52ddaba73e7ee554ef42c4328.exe
3896	0cf2dcd52ddaba73e7ee554ef42c4328.exe
3896	0cf2dcd52ddaba73e7ee554ef42c4328.exe
3896	0cf2dcd52ddaba73e7ee554ef42c4328.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0cf2dcd52ddaba73e7ee554ef42c4328.exe

description pid process

Token: SeDebugPrivilege 3896 0cf2dcd52ddaba73e7ee554ef42c4328.exe

description	pid	process
Token: SeDebugPrivilege	3896	0cf2dcd52ddaba73e7ee554ef42c4328.exe

C:\Users\Admin\AppData\Local\Temp\0cf2dcd52ddaba73e7ee554ef42c4328.exe
"C:\Users\Admin\AppData\Local\Temp\0cf2dcd52ddaba73e7ee554ef42c4328.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
740B

MD5
f8a6e7b28975f215319e8fe370ccd6ae

SHA1
8447eb05519b2f523548d016534d6af8293c69f3

SHA256
b407c68461c6a6f4c5107e9ec914de9b04bd852ed23c3bf31d344d50ed00c371

SHA512
cbd36b50198c19380ac76f41b99dfabff0fa304ccaa6312a9dcf02c5e3847b24bbb6eb327d8310d3c7137329e39f15974cf38ae81b9d537ce3a2f40e655eff2c

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
300b003e79f45d02f57c5a64a34f947f

SHA1
944bc04c612e8a8edd0e22d574f831e220d37fdd

SHA256
970f63e7f3d8ed87be6d902dcb6bdd9512c25d2030bfce1e8e17b879520b163c

SHA512
61824f777f50f65ff79f9254d112d0220ebe26fd2a90dea18f88dd289ca5ced345b060c27d2e86ec228e385b6a4b688ed195470c37a8f4a1597a4e4125d9cb1b

Download Submit
memory/3896-0-0x00000000009E0000-0x0000000000A80000-memory.dmp

Filesize
640KB

Download
memory/3896-1-0x00007FFB4DB40000-0x00007FFB4E601000-memory.dmp

Filesize
10.8MB

Download
memory/3896-2-0x0000000001320000-0x0000000001326000-memory.dmp

Filesize
24KB

Download
memory/3896-3-0x000000001B6E0000-0x000000001B6F0000-memory.dmp

Filesize
64KB

Download
memory/3896-4-0x000000001B910000-0x000000001B9EA000-memory.dmp

Filesize
872KB

Download
memory/3896-5-0x0000000001330000-0x0000000001336000-memory.dmp

Filesize
24KB

Download
memory/3896-127-0x00007FFB4DB40000-0x00007FFB4E601000-memory.dmp

Filesize
10.8MB

Download