Analysis
- max time kernel
210s - max time network
219s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
09/01/2024, 13:16
General
- Target 4e66b442315b528793daf29f272beb6e.exe
- Size 13.2MB
- Sample240109-qh282abcan
- SHA256 f920013efc8d6839e9ff3a2ce43010e1fb46a941a95f99b8c39335d1fbb1bc29
Malware Config
Extracted
-
44caliber
-
https://discord.com/api/webhooks/864993390039138344/KcIraJ14D-c_gxt8b62QhfVu_PGaoIgxX5A9WLR2Iw9WLUoF8VGIsnRR969mXFvP0Unf
Signatures
- 44Caliber
An open source infostealer written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 21 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e66b442315b528793daf29f272beb6e.exe"C:\Users\Admin\AppData\Local\Temp\4e66b442315b528793daf29f272beb6e.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\duTN6Ni35B.exe"C:\Users\Admin\AppData\Local\Temp\duTN6Ni35B.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\dh4nEchLKF.exe"C:\Users\Admin\AppData\Local\Temp\dh4nEchLKF.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause > nul3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
Process.txt
dh4nEchLKF.exe
dh4nEchLKF.exe
dh4nEchLKF.exe
duTN6Ni35B.exe
duTN6Ni35B.exe
duTN6Ni35B.exe
memory/1356-17-0x000000001B890000-0x000000001B8A0000-memory.dmp
memory/1356-16-0x00007FFCC5460000-0x00007FFCC5F21000-memory.dmp
memory/1356-12-0x0000000000B30000-0x0000000000B7A000-memory.dmp
memory/1356-164-0x00007FFCC5460000-0x00007FFCC5F21000-memory.dmp
memory/1356-161-0x000000001B890000-0x000000001B8A0000-memory.dmp
memory/1356-158-0x00007FFCC5460000-0x00007FFCC5F21000-memory.dmp
memory/3500-0-0x0000000000400000-0x000000000142A000-memory.dmp
memory/3500-54-0x0000000000400000-0x000000000142A000-memory.dmp
memory/5060-155-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-169-0x00007FFCE3460000-0x00007FFCE351E000-memory.dmp
memory/5060-154-0x00007FFCA3470000-0x00007FFCA3480000-memory.dmp
memory/5060-58-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-156-0x00007FFCE3460000-0x00007FFCE351E000-memory.dmp
memory/5060-57-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-159-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-56-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-55-0x00007FFCE41B0000-0x00007FFCE43A5000-memory.dmp
memory/5060-165-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-166-0x00007FFCE41B0000-0x00007FFCE43A5000-memory.dmp
memory/5060-106-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-168-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-171-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-173-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-175-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-177-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-179-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-181-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-183-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-185-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-187-0x00007FF697240000-0x00007FF6986E5000-memory.dmp
memory/5060-189-0x00007FF697240000-0x00007FF6986E5000-memory.dmp