44caliber | 0ffc4a30a0719e18e81d17c1aa2a0880ccde91f27a69ddc5682405037f41467b

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2024 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a73b2e83b8267fc1b40cd1c42f59116.exe
Size

121KB
MD5

6a73b2e83b8267fc1b40cd1c42f59116
SHA1

bf63ed29fdeae42260eccbef0c511ee77f8f0339
SHA256

0ffc4a30a0719e18e81d17c1aa2a0880ccde91f27a69ddc5682405037f41467b
SHA512

8f3614e4d9a9baf4185cb2d2bdc19a937cdec9260a5dc9dbcdc5db2797d376dc093f2c2ebd55a427475644c2780655d1895a0f610133ce57d969ea46df9ec37a
SSDEEP

1536:eNwXyLxpNnonJsrZ8/l+LguMSxPBuVWDaAruae9/gTlSmE8eLU534GwvfAeB+R0U:2hxp8JgZ29ubBOWwx9YD8jhvoo+RANG

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/857773959478116362/1HjPquy4G_ltau-JO_b28kVAgNjquEwJ8dvlwS9dY_P5TQ_PcQA7UEAQc80CznKxgRVd

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	6a73b2e83b8267fc1b40cd1c42f59116.exe

Executes dropped EXE 1 IoCs

pid	Process
2100	HELL Client (Beta).exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	freegeoip.app
3	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	HELL Client (Beta).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	HELL Client (Beta).exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6a73b2e83b8267fc1b40cd1c42f59116.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2100	HELL Client (Beta).exe
2100	HELL Client (Beta).exe
2100	HELL Client (Beta).exe
2100	HELL Client (Beta).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	HELL Client (Beta).exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2100	4636	6a73b2e83b8267fc1b40cd1c42f59116.exe	87
PID 4636 wrote to memory of 2100	4636	6a73b2e83b8267fc1b40cd1c42f59116.exe	87

C:\Users\Admin\AppData\Local\Temp\6a73b2e83b8267fc1b40cd1c42f59116.exe
"C:\Users\Admin\AppData\Local\Temp\6a73b2e83b8267fc1b40cd1c42f59116.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\Documents\HELL Client (Beta).exe
  "C:\Users\Admin\Documents\HELL Client (Beta).exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
7d54f6c4e1c6949878e1266fc2944e1d

SHA1
ca74297c62cc71547cbd8361bb5f310f0742f959

SHA256
193a0ce661ae2a54234fd277a0089365ddfdcc4d3315d91fc01a75b220bc46cb

SHA512
209d7f5233ff1efabeb36fb771914bffaa8cae7a912b145e59febd899f6af523a928a56e7a1b4797b3af5eddaac476fe87ac18732103083e1ed201be28eb54f1

Download Submit
C:\Users\Admin\Documents\HELL Client (Beta).exe

Filesize
274KB

MD5
d8e815c8a5a3b8faf325f65e61456613

SHA1
465f915d9601df9da4f518c4717bba9e7c425870

SHA256
1590226cbdb796bfb1638bd2295a7b169a6f1168cdcb2c0d17a6c7dc2ae5dfb4

SHA512
28bfe46c5d16b432d2ac623157a80f9ecf40d81eb8e49249ce329611ef65145cd65c85ac63cc57a46489d43a27cc633aa6e63bcbf5f0f485adc7a3537b4ef310

Download Submit
memory/2100-64-0x00000000004D0000-0x000000000051A000-memory.dmp

Filesize
296KB

Download
memory/2100-66-0x00007FFB79F80000-0x00007FFB7AA41000-memory.dmp

Filesize
10.8MB

Download
memory/2100-81-0x000000001B210000-0x000000001B220000-memory.dmp

Filesize
64KB

Download
memory/2100-188-0x00007FFB79F80000-0x00007FFB7AA41000-memory.dmp

Filesize
10.8MB

Download
memory/4636-0-0x0000000000900000-0x0000000000924000-memory.dmp

Filesize
144KB

Download
memory/4636-1-0x00007FFB79F80000-0x00007FFB7AA41000-memory.dmp

Filesize
10.8MB

Download
memory/4636-4-0x000000001B500000-0x000000001B510000-memory.dmp

Filesize
64KB

Download
memory/4636-65-0x00007FFB79F80000-0x00007FFB7AA41000-memory.dmp

Filesize
10.8MB

Download