Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 13:18
General
-
Target
37ac48c6a31ec8e83e4b92f03e729917.exe
-
Size
274KB
-
MD5
37ac48c6a31ec8e83e4b92f03e729917
-
SHA1
ae3fb437257f048177223eff1df8f4a009aa6545
-
SHA256
be163731cfe152309f2f36332968aa275edef44ede0544d9fa37d26ce530cb77
-
SHA512
9209bf598ee9caa514700921cea8a2e788ce76eb03bf7acb0f21c462859974792d6bcf41d57a0578db90d79a86355556ed87717ee15caf4a5019448fe8d88c30
-
SSDEEP
6144:Gf+BLtABPD9NF/DVGK7zeNL+dN41V6GIeyXyRA1D0kj2:wNKK7zeNL2Y69eyXX1DL2
Malware Config
Extracted
44caliber
https://discordapp.com/api/webhooks/859014405580783637/J-rOLcLQORAp4rSIpre0H46Lhmzd8QK1hgRFNA4mqYSEz6dtJRq9HsK-id725NgqZTvK
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37ac48c6a31ec8e83e4b92f03e729917.exe"C:\Users\Admin\AppData\Local\Temp\37ac48c6a31ec8e83e4b92f03e729917.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516B
MD5ebe7de772ba5023732bcf6e9bab7ff59
SHA1abcd7ca6579bfd6bd396f89077238602e483ee83
SHA256840fa6110f3cfbf1f06561d3edc479b4f1b14651fc8080a720e56c5aab2a1742
SHA5129077e9f80732f6af66907c12f9c744493d793ea068457c9a0bc9c9ce1d245210d23a0cac44a9d1ca76c850c174b8693c5ac21044e3f2057fddd999da70f0b880
-
Filesize
759B
MD55a53230bc0791e7fabb483095368a9b2
SHA103ece9526af92fd1bda797226ea119074f41ca76
SHA2565deaa448c46606d13995e3b725d0cb17c244835141b6f5a8a986f43223b41b2a
SHA5125be342ad0f24c9330cfa4e449b20a7fc2012e51605b01dd9d79ad151cc4a7e18abb7ad67c9de96f416dd01fd2cc85593210c0ba2afb3589bf592fc8585c5b1b9
-
Filesize
1KB
MD52bbdad197491c46933fc9113ba7bd7a0
SHA11a6fbe3d849aa19f6257dd3d1990ef666a4f5407
SHA2565b52c29bb6f9e080810c0bf549235f875ad45c2d1ebc3d1de0a832f5ff7a5436
SHA512d832d288e24ac85078a6e5b5c8de6c7d30c4b169f010248febbc4a6c69af6f373a10e7254cb1e2200d3fab43ce9129c8653d7173fd7e4c1faac936c722138d82
-
Filesize
296KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB