44caliber | 1ea45c54e59585e1cd3b415c1a8dd4e5e6146559802d55ad00549e88d0dad03c

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SerotoninLoader.exe
Size

274KB
MD5

a1e427ad2ef7f222aa66a6256eae9470
SHA1

5bf1775f86b3c20387f164055322692ef1e2a508
SHA256

1ea45c54e59585e1cd3b415c1a8dd4e5e6146559802d55ad00549e88d0dad03c
SHA512

59cd96e21c224301bd9721852c4714436b7896f5cddb55c39715bdfa4b33100a7bc8d86246f2c211e365cab2f8f41acb091ed1089756d9dd24ff0bdf76e46cf7
SSDEEP

6144:of+BLtABPDslRpZrQWT0IQZQZtafTy8lI1D0Qkv:jlmK0IQZQNx1Dov

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1190238303706943558/sspm8U_-iZm0lPr7lzq2HlHtwE1OvN49WbP5Wq0jsesUiJAxFQ_ILy_elOLuM4tFYIXC

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	freegeoip.app
4	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	SerotoninLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SerotoninLoader.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1572	SerotoninLoader.exe
1572	SerotoninLoader.exe
1572	SerotoninLoader.exe
1572	SerotoninLoader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	SerotoninLoader.exe

C:\Users\Admin\AppData\Local\Temp\SerotoninLoader.exe
"C:\Users\Admin\AppData\Local\Temp\SerotoninLoader.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
1KB

MD5
5bdc3e4c99f00f0bd8f1f9f5ffd0f2b3

SHA1
9203a8e49a3b1eeffd7f5dc07ba9735381b7ece7

SHA256
d79bab573918c198aa92df6246f7c23ee7e1c525911c1011869806e553d7896e

SHA512
85661a178d585b113e65ffddc0f216a4579f737fa3b4b78d2997c0ff5b2c2a92423ce364e8a2cd329bc7e8f096f619308416c37994e3c8053b5eb3472a7aac9a

Download Submit
memory/1572-0-0x00000234C5760000-0x00000234C57AA000-memory.dmp

Filesize
296KB

Download
memory/1572-31-0x00007FF8FCFB0000-0x00007FF8FDA71000-memory.dmp

Filesize
10.8MB

Download
memory/1572-32-0x00000234C7610000-0x00000234C7620000-memory.dmp

Filesize
64KB

Download
memory/1572-122-0x00007FF8FCFB0000-0x00007FF8FDA71000-memory.dmp

Filesize
10.8MB

Download