Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-01-2024 20:16
General
-
Target
02c9b93a30cac707fcf002a0de796ffa.exe
-
Size
2.2MB
-
MD5
02c9b93a30cac707fcf002a0de796ffa
-
SHA1
bfdc0777ef4d84a248045919fae0e2fc9ba33952
-
SHA256
d580e3cc2480f082f140cc784c0249f19d0c412d7758fb97ba8e750441188bb6
-
SHA512
05fde0d4e1afbc0e5d3d7315fee4016caf5a5ed8f2365062cbb8588fb7552d8fd999a82e8f2360336b77bd0ffc9eb39c62aca5992e709f781f80e64bf561feb7
-
SSDEEP
49152:QwoR6eo4uwBM3RlNpDE15UR43WNKrAdlK4MI0Q:qNokMBlLDE1W+uuAIJ
Malware Config
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02c9b93a30cac707fcf002a0de796ffa.exe"C:\Users\Admin\AppData\Local\Temp\02c9b93a30cac707fcf002a0de796ffa.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD559cec57f2ac55e6a4c3f1922c3c1b3ed
SHA11ab32785d235159da2ca41a1ee130f76e5c501bf
SHA256d1bcc7cbc3790ae4f8c2a9849af815fce47412691830829132fd54f4d80bb05d
SHA512c098fbf21ac89c38f30494896a8e36f97db16fd28e522d22e3c84742ba78b9a76dbc4c3b0385e26f208eff016d83cd8eb82d6fde443d58796c1ee11d88f848d4
-
Filesize
525B
MD5819a9f46f618e7f2fc87ca76414632a0
SHA175c5d1d64a4702ac75e0cd600d8cc23e1364a5f3
SHA2561212e79604d764699f0b4d32e8824ba618a4f5d12355f13b05417d2ab438bdf5
SHA512198f43cc4c25f84a865b763f4c61cef4fdcfa3e35b0a8c948a385d7c1a3219b505615cee1edadd3dc8892e7d73cbc1a96f0a06f8d26d3f202ab190d862de7d0b
-
Filesize
968B
MD523027f472f1337fd7e82b9ab0b68acf0
SHA1ff2130b9f274d3c47ee6c49beb42c9bceb18b6fe
SHA256c10ca49fad16475f0c7d5908da773438334d17c0667499ce3f1f2a696654030d
SHA512969910704a53768da700564f56df5b9df12973e042882520f275e7b0cabf51fd910952e15718d5771b810d8d969f32a4677ac8d4e374f42e5d1ca82eb25ea6a4
-
Filesize
1KB
MD5ab4f195bbdf3958557f7de0fff83d910
SHA1f0b1e7ba6a27303f52622932174ae03317603059
SHA2565111c5c74a8319afa71288cc6d4656b3ee27742b71d55da02600622fb84f9815
SHA512eee66a6cee211013627cafb8d8bcc47871e3134236ac09d1e962e8e0abcd1351c3bdaa0d24a989763c2b8defe19f5a0e416b33766645f3989c29458aceb0c667
-
Filesize
2.2MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB