Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
22-01-2024 00:55
General
-
Target
6e4b2af9613621fcf93169e9e675a83d.exe
-
Size
1.2MB
-
MD5
6e4b2af9613621fcf93169e9e675a83d
-
SHA1
c73f05cc03da6fae9d02dae5c27a39ad27e614f8
-
SHA256
699f85530a90e3aa36ff9e89dd99eb80c9c183e5b4051f05563519207a6f43f1
-
SHA512
35a8322abfa612c2e26f1ba182ac9ec329d52f64d0e65957ab75e6e9e8c4b91f12dc7b654e63bcb635ed76cbae4a99c9cc3474ef68c447cb8b53a3f530e1130b
-
SSDEEP
24576:BxvZEnWSE8QUvZE7ip4eTIFKEEHpded5mdKv1rVewecDM:BxvZEWeQuE7Mbpd4mqrJDM
Malware Config
Extracted
44caliber
https://ptb.discord.com/api/webhooks/860353023338086430/2Qd4HlzQHur0rzkKBP2Vm6f3rps1M95uCLN9BFhgxoNcoNZaddzQ1WGM0rfQd1x1RjdF
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e4b2af9613621fcf93169e9e675a83d.exe"C:\Users\Admin\AppData\Local\Temp\6e4b2af9613621fcf93169e9e675a83d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
1KB
MD5d98de4f14206281e527374886657c6d0
SHA14ae5d40fcab7e75d6bcd6e7064e568b4c60a0d8a
SHA256da69d8f29ec3ac53536753ee745fddc70d4d7d9182f8a390d4c71675277351a6
SHA512b58536972549509a6bd48081347e9eda7c624fd8a2737ddccc95a5f0430e4c183b2cfaf71b03e92d38b1eaf0ffe4ead093a511a374eb23469cff2afbd67838fe
-
Filesize
488B
MD547e2b2cb3a7b5781a76ecb80525437d0
SHA1c479431659211f9d33fc5c55f3a0de43b488a740
SHA256edac86a0c6bc2771f8a89dded6416f3999a281b3d591ffd4bcc330b8f965924f
SHA5126127340337801b7f7e07300c21750e7f3791737ece00d09ae69d98a6dc32cbd0b6bf07a062a2428a43fd7d82395083b6ea456158de62142c1178e1fd61d572e6
-
Filesize
503B
MD58c85cedacdd3d1067ea62fdd366dd7d0
SHA1bf171b472c6c620605a674f45014573bee3badbe
SHA2563560c14c35c684672b9b4c0cc824cd4a39e58dbffb73f974f2186d648fe07a7c
SHA512e60a07a8ca202ac549bf65fb432fcffe644b8ad6323f514cc47eb31c0b66cf973e08330207a2f41708b618d72abba31fedd86d5d5ed11f1bbe6da8edeea236f0
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
7.7MB