Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
20-01-2024 16:21
General
-
Target
6ae3498cb9a5ba2b89861ecd5af12627.exe
-
Size
12.4MB
-
MD5
6ae3498cb9a5ba2b89861ecd5af12627
-
SHA1
274f104b6115ede9bf664ba7a82862dc35808bba
-
SHA256
fab22062cd6dca945108eec308117d1f61776f165a589b0dc40631e853f54739
-
SHA512
4523fae5e13f8a23afd0b2a1ee905ac6714b2f2c52892c807d3ee3cc8065a41ff1f8c3a70e34c19c32737b11e6228c3ecdf394e5fbe0b24b3894398785558bef
-
SSDEEP
196608:pFYCPzfo99IAREBpvabnMxoVu1AQLC00atf/V85x8ew1Gfp4q/J4iylWCpmKLQgU:dPro99IACv7r1Jkav4xigxJ/clW3gs9
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/870328559921668146/kazDUWGIa2HOkULS2qQpDIz38by-5RiNdWFILJQZSPRi2F9j1-5L1rtRf7yO0-V87Q4N
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ae3498cb9a5ba2b89861ecd5af12627.exe"C:\Users\Admin\AppData\Local\Temp\6ae3498cb9a5ba2b89861ecd5af12627.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31.0MB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
31.0MB
-
Filesize
9.9MB
-
Filesize
31.0MB
-
Filesize
31.0MB
-
Filesize
512KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
31.0MB
-
Filesize
1.7MB
-
Filesize
9.9MB