44caliber | 699f85530a90e3aa36ff9e89dd99eb80c9c183e5b4051f05563519207a6f43f1

General

Target

6e4b2af9613621fcf93169e9e675a83d.exe
Size

1.2MB
MD5

6e4b2af9613621fcf93169e9e675a83d
SHA1

c73f05cc03da6fae9d02dae5c27a39ad27e614f8
SHA256

699f85530a90e3aa36ff9e89dd99eb80c9c183e5b4051f05563519207a6f43f1
SHA512

35a8322abfa612c2e26f1ba182ac9ec329d52f64d0e65957ab75e6e9e8c4b91f12dc7b654e63bcb635ed76cbae4a99c9cc3474ef68c447cb8b53a3f530e1130b
SSDEEP

24576:BxvZEnWSE8QUvZE7ip4eTIFKEEHpded5mdKv1rVewecDM:BxvZEWeQuE7Mbpd4mqrJDM

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://ptb.discord.com/api/webhooks/860353023338086430/2Qd4HlzQHur0rzkKBP2Vm6f3rps1M95uCLN9BFhgxoNcoNZaddzQ1WGM0rfQd1x1RjdF

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 freegeoip.app
7 freegeoip.app
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

6e4b2af9613621fcf93169e9e675a83d.exe

pid process

1584 6e4b2af9613621fcf93169e9e675a83d.exe

flow	ioc
6	freegeoip.app
7	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6e4b2af9613621fcf93169e9e675a83d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	6e4b2af9613621fcf93169e9e675a83d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	6e4b2af9613621fcf93169e9e675a83d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6e4b2af9613621fcf93169e9e675a83d.exe

pid	process
1584	6e4b2af9613621fcf93169e9e675a83d.exe
1584	6e4b2af9613621fcf93169e9e675a83d.exe
1584	6e4b2af9613621fcf93169e9e675a83d.exe
1584	6e4b2af9613621fcf93169e9e675a83d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6e4b2af9613621fcf93169e9e675a83d.exe

description pid process

Token: SeDebugPrivilege 1584 6e4b2af9613621fcf93169e9e675a83d.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6e4b2af9613621fcf93169e9e675a83d.exe

pid process

1584 6e4b2af9613621fcf93169e9e675a83d.exe

description	pid	process
Token: SeDebugPrivilege	1584	6e4b2af9613621fcf93169e9e675a83d.exe

C:\Users\Admin\AppData\Local\Temp\6e4b2af9613621fcf93169e9e675a83d.exe
"C:\Users\Admin\AppData\Local\Temp\6e4b2af9613621fcf93169e9e675a83d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\ProgramData\44\Process.txt
Filesize
1KB

MD5
d98de4f14206281e527374886657c6d0

SHA1
4ae5d40fcab7e75d6bcd6e7064e568b4c60a0d8a

SHA256
da69d8f29ec3ac53536753ee745fddc70d4d7d9182f8a390d4c71675277351a6

SHA512
b58536972549509a6bd48081347e9eda7c624fd8a2737ddccc95a5f0430e4c183b2cfaf71b03e92d38b1eaf0ffe4ead093a511a374eb23469cff2afbd67838fe

Download Submit
C:\ProgramData\44\Process.txt
Filesize
488B

MD5
47e2b2cb3a7b5781a76ecb80525437d0

SHA1
c479431659211f9d33fc5c55f3a0de43b488a740

SHA256
edac86a0c6bc2771f8a89dded6416f3999a281b3d591ffd4bcc330b8f965924f

SHA512
6127340337801b7f7e07300c21750e7f3791737ece00d09ae69d98a6dc32cbd0b6bf07a062a2428a43fd7d82395083b6ea456158de62142c1178e1fd61d572e6

Download Submit
C:\ProgramData\44\Process.txt
Filesize
503B

MD5
8c85cedacdd3d1067ea62fdd366dd7d0

SHA1
bf171b472c6c620605a674f45014573bee3badbe

SHA256
3560c14c35c684672b9b4c0cc824cd4a39e58dbffb73f974f2186d648fe07a7c

SHA512
e60a07a8ca202ac549bf65fb432fcffe644b8ad6323f514cc47eb31c0b66cf973e08330207a2f41708b618d72abba31fedd86d5d5ed11f1bbe6da8edeea236f0

Download Submit
memory/1584-1-0x0000000000C80000-0x000000000102C000-memory.dmp

Filesize
3.7MB

Download
memory/1584-3-0x0000000000C80000-0x000000000102C000-memory.dmp

Filesize
3.7MB

Download
memory/1584-4-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

Filesize
64KB

Download
memory/1584-5-0x00000000063B0000-0x0000000006442000-memory.dmp

Filesize
584KB

Download
memory/1584-2-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/1584-38-0x0000000006DC0000-0x0000000007364000-memory.dmp

Filesize
5.6MB

Download
memory/1584-127-0x0000000007E20000-0x0000000007E86000-memory.dmp

Filesize
408KB

Download
memory/1584-0-0x0000000000C80000-0x000000000102C000-memory.dmp

Filesize
3.7MB

Download
memory/1584-131-0x0000000000C80000-0x000000000102C000-memory.dmp

Filesize
3.7MB

Download
memory/1584-132-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing