44caliber | 81673703e3620dd4760abc876882185a901fdebdd9db9ec6caad172adce76306

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58c1a37139dc07fd0d4d800032cc65d0.exe
Size

1.7MB
MD5

58c1a37139dc07fd0d4d800032cc65d0
SHA1

62474977ece1d8b71400474d4998497089918c12
SHA256

81673703e3620dd4760abc876882185a901fdebdd9db9ec6caad172adce76306
SHA512

59dc2d2cf0a321b960af505231d5fbc373abc59a8f5fe2cf6c0c0908d68bb4454a176ba02243334e6331e6d5831c32b08dbd54bc290bbf02dc213f9d6677a365
SSDEEP

49152:cuYkCr6/VlG1D3bGTHcQHl3Ll3HoCgn/Pa9MdYxGtbR:QVr6/21yR3h3IC8iKdd9

Score

10^/10

44caliber blackguard spyware stealer

Malware Config

Extracted

Family

blackguard

https://api.telegram.org/bot1835956767:AAHk1asCy0CiwJAclHm32rLK9Ng48TPYeeA/sendMessage?chat_id=1329554755

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 freegeoip.app
3 freegeoip.app
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

58c1a37139dc07fd0d4d800032cc65d0.exe

pid process

1708 58c1a37139dc07fd0d4d800032cc65d0.exe
1708 58c1a37139dc07fd0d4d800032cc65d0.exe

flow	ioc
2	freegeoip.app
3	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

58c1a37139dc07fd0d4d800032cc65d0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	58c1a37139dc07fd0d4d800032cc65d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	58c1a37139dc07fd0d4d800032cc65d0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

58c1a37139dc07fd0d4d800032cc65d0.exe

pid	process
1708	58c1a37139dc07fd0d4d800032cc65d0.exe
1708	58c1a37139dc07fd0d4d800032cc65d0.exe
1708	58c1a37139dc07fd0d4d800032cc65d0.exe
1708	58c1a37139dc07fd0d4d800032cc65d0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

58c1a37139dc07fd0d4d800032cc65d0.exe

description pid process

Token: SeDebugPrivilege 1708 58c1a37139dc07fd0d4d800032cc65d0.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

58c1a37139dc07fd0d4d800032cc65d0.exe

pid process

1708 58c1a37139dc07fd0d4d800032cc65d0.exe

description	pid	process
Token: SeDebugPrivilege	1708	58c1a37139dc07fd0d4d800032cc65d0.exe

C:\Users\Admin\AppData\Local\Temp\58c1a37139dc07fd0d4d800032cc65d0.exe
"C:\Users\Admin\AppData\Local\Temp\58c1a37139dc07fd0d4d800032cc65d0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
412B

MD5
f5e69f6edfd6df989b831989d06e4c2b

SHA1
e2e583f37795437a5f5f4b051a7c1130d790d0f8

SHA256
b792332b7c480fb3541d2ae82f133fa96e8f2fd19f02bd07a6905f9adf352241

SHA512
e726b599d77debc3f33457ec3be6e362ac24645cb045eaddbd1b4cba7885d9a2b5e3b4a0ce79f6e7b17f75dd8ca247e26679e32e9f4897bbe3c027b95bd8dd4c

Download Submit
memory/1708-0-0x00000000008F0000-0x0000000000DCE000-memory.dmp

Filesize
4.9MB

Download
memory/1708-2-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-1-0x00000000008F0000-0x0000000000DCE000-memory.dmp

Filesize
4.9MB

Download
memory/1708-3-0x0000000005840000-0x0000000005880000-memory.dmp

Filesize
256KB

Download
memory/1708-68-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/1708-67-0x0000000002550000-0x000000000255A000-memory.dmp

Filesize
40KB

Download
memory/1708-71-0x00000000008F0000-0x0000000000DCE000-memory.dmp

Filesize
4.9MB

Download
memory/1708-72-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download