Analysis
-
max time kernel
7s -
max time network
7s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
10-01-2024 18:14
General
-
Target
51426225675c0ddb35e94704265ae42f.exe
-
Size
5KB
-
MD5
51426225675c0ddb35e94704265ae42f
-
SHA1
c28dffec6f9478034bebdb6a2328c5fdfd370a24
-
SHA256
7a84efcf08949adc80fc115f1da3fe4f153e270eb047ea8e96a584299936324e
-
SHA512
a7d62e5e096c69508adc0f201dbc5c4c9d32ebe075851b1fd5c7945143d222b7a7018796f9a0ed355173510eecf624215bf654a64259ab0bedb2c6baf1e9d63a
-
SSDEEP
48:6ZccNnlZOJ6dbKhIBo7hzNMPB+0b9ZSMLuYbr/it1PlPvP7FYvpfbNtm:O3OJ6db2H7cDbydv6BzNt
Score
10/10
Malware Config
Extracted
Family
44caliber
C2
https://discord.com/api/webhooks/870312877347717170/6XS4TbEnvrNxzmzuSVtOYoUeIAugviKP_WONyL7CmXFhGDJBGjGfxflBEEinBRzZwIi7
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51426225675c0ddb35e94704265ae42f.exe"C:\Users\Admin\AppData\Local\Temp\51426225675c0ddb35e94704265ae42f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2kco4xji.djw.exe"C:\Users\Admin\AppData\Local\Temp\2kco4xji.djw.exe"2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
296KB
-
Filesize
10.8MB