44caliber | 8f727f5b33bac619cc7bbfe7ff24352319657cc603c687777b845babf018b932

General

Target

7786d92296517e19d9ef43301d5e9683.exe
Size

1.2MB
MD5

7786d92296517e19d9ef43301d5e9683
SHA1

846dcd8fca2ee19c26b0b8b79b0f41c8982ce907
SHA256

8f727f5b33bac619cc7bbfe7ff24352319657cc603c687777b845babf018b932
SHA512

03dd20dd3def940ed6813405f986c172470a5c16cfc4163adfccb6ae3368e2ab4d042409d3b8e20abaa371838fae853a3ddf9f4e7b61d7167c06046a7381ce3a
SSDEEP

24576:pV2mtR9JIsBWHjnU2TttCrP8rIKDe1z+5IbkNritj:pjv9JIsBWHbpPUhZmIbkNrq

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/878380228894937168/1FKbQhM8XJ4ozljtwifZ-1m-XeYw5uknMJLH4X2t0Qxup8aulmWIgdRLa1z0jAtb9Z9u

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	freegeoip.app
6	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2700	7786d92296517e19d9ef43301d5e9683.exe
2700	7786d92296517e19d9ef43301d5e9683.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	7786d92296517e19d9ef43301d5e9683.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	7786d92296517e19d9ef43301d5e9683.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2700	7786d92296517e19d9ef43301d5e9683.exe
2700	7786d92296517e19d9ef43301d5e9683.exe
2700	7786d92296517e19d9ef43301d5e9683.exe
2700	7786d92296517e19d9ef43301d5e9683.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	7786d92296517e19d9ef43301d5e9683.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2700	7786d92296517e19d9ef43301d5e9683.exe

C:\Users\Admin\AppData\Local\Temp\7786d92296517e19d9ef43301d5e9683.exe
"C:\Users\Admin\AppData\Local\Temp\7786d92296517e19d9ef43301d5e9683.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
1KB

MD5
41fddc7345ac3bfc68c128b8acaea023

SHA1
81a3388913b86169bc7ae14b9804e94d2e5c17fe

SHA256
48e93378d68b1ef54e848febde79f07c4c77f9ac74a3791db7d968171badbdca

SHA512
84a9ac268052403de430c8ca46f2387a12f88c87355ab5e866f8cc5043df39cca30b630b458c23b55540442aeca67d8a1fe6deda1db085ef89b2bd40e9d4a14b

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
245B

MD5
0e31df038f9fc7941ae63172d31a9852

SHA1
53394ee520e8da715fd73773deb14e4535c6ef69

SHA256
8f508d0e48ca5e1b7075fd41da1e6867eff94e0e51b9ec151d3466aac9d5085e

SHA512
87194d6014b16c14f559d26edec695eddb745dd80f22bfd165ed44ace48acdb32c7a6931bd9aaeaf3bb24ee058bf1a6779d3a5c130f71addbbbe82fd435304d3

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
402B

MD5
a3de1d7d1ca59ee9f82e2e12713e8106

SHA1
e30b20fe5cbf743a39bdf88fa12539369fc39f1f

SHA256
70e532aa4d713364c2345fd7cf1b03a6f370fb48b019b1b87c4d4171096b3c67

SHA512
dae89558891bb65ba86bbe8f71a49c862b227010496a06994538e20c58ae18daca6096d65dec586ad6da07531828644ffe5b084c7b9948c80bf6a3a41429425c

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
843B

MD5
b6559cdfe267c632c9232ff3739f800c

SHA1
ec7f39055b7f833da120491c42ea18dc0d750904

SHA256
2eea42c283e08c4ea7241fe620a208059c321f3c33d66e9b1f15e7777cbf8c35

SHA512
85424daa22741678c94cc886ccd731d6d4b8953b4968ff756c1159be72d5502e0f99a0ee0e896f771b8bd488133a4835cb1b73c7c171743a1f98261b600a5725

Download Submit
memory/2700-5-0x0000000006500000-0x0000000006592000-memory.dmp

Filesize
584KB

Download
memory/2700-1-0x0000000000680000-0x0000000000A2C000-memory.dmp

Filesize
3.7MB

Download
memory/2700-38-0x0000000006F10000-0x00000000074B4000-memory.dmp

Filesize
5.6MB

Download
memory/2700-127-0x0000000007BE0000-0x0000000007C46000-memory.dmp

Filesize
408KB

Download
memory/2700-0-0x0000000000680000-0x0000000000A2C000-memory.dmp

Filesize
3.7MB

Download
memory/2700-3-0x0000000000680000-0x0000000000A2C000-memory.dmp

Filesize
3.7MB

Download
memory/2700-2-0x0000000073E90000-0x0000000074640000-memory.dmp

Filesize
7.7MB

Download
memory/2700-4-0x0000000005B10000-0x0000000005B20000-memory.dmp

Filesize
64KB

Download
memory/2700-131-0x0000000000680000-0x0000000000A2C000-memory.dmp

Filesize
3.7MB

Download
memory/2700-132-0x0000000073E90000-0x0000000074640000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing