Analysis
- max time kernel
141s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
20/01/2024, 16:21
General
- Target 6ae3498cb9a5ba2b89861ecd5af12627.exe
- Size 12.4MB
- Sample240120-tt5p3sdca8
- SHA256 fab22062cd6dca945108eec308117d1f61776f165a589b0dc40631e853f54739
Malware Config
Extracted
-
44caliber
-
https://discord.com/api/webhooks/870328559921668146/kazDUWGIa2HOkULS2qQpDIz38by-5RiNdWFILJQZSPRi2F9j1-5L1rtRf7yO0-V87Q4N
Signatures
- 44Caliber
An open source infostealer written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ae3498cb9a5ba2b89861ecd5af12627.exe"C:\Users\Admin\AppData\Local\Temp\6ae3498cb9a5ba2b89861ecd5af12627.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Process.txt
Process.txt
memory/2988-5-0x00007FFC00030000-0x00007FFC00031000-memory.dmp
memory/2988-12-0x00007FF75C670000-0x00007FF75E574000-memory.dmp
memory/2988-0-0x00007FF75C670000-0x00007FF75E574000-memory.dmp
memory/2988-6-0x00007FFC28730000-0x00007FFC28925000-memory.dmp
memory/2988-9-0x00007FF75C670000-0x00007FF75E574000-memory.dmp
memory/2988-10-0x00007FF75C670000-0x00007FF75E574000-memory.dmp
memory/2988-11-0x00007FFC09320000-0x00007FFC09DE1000-memory.dmp
memory/2988-4-0x00007FFC00000000-0x00007FFC00002000-memory.dmp
memory/2988-13-0x000000001CE40000-0x000000001CE50000-memory.dmp
memory/2988-3-0x00007FFC264B0000-0x00007FFC26779000-memory.dmp
memory/2988-1-0x00007FFC264B0000-0x00007FFC26779000-memory.dmp
memory/2988-138-0x00007FF75C670000-0x00007FF75E574000-memory.dmp
memory/2988-139-0x00007FFC264B0000-0x00007FFC26779000-memory.dmp
memory/2988-140-0x00007FFC28730000-0x00007FFC28925000-memory.dmp
memory/2988-141-0x00007FFC09320000-0x00007FFC09DE1000-memory.dmp