Overview

overview

10

Static

static

3

7786d92296...83.exe

windows7-x64

10

7786d92296...83.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-01-2024 13:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7786d92296517e19d9ef43301d5e9683.exe

  • Size

    1.2MB

  • MD5

    7786d92296517e19d9ef43301d5e9683

  • SHA1

    846dcd8fca2ee19c26b0b8b79b0f41c8982ce907

  • SHA256

    8f727f5b33bac619cc7bbfe7ff24352319657cc603c687777b845babf018b932

  • SHA512

    03dd20dd3def940ed6813405f986c172470a5c16cfc4163adfccb6ae3368e2ab4d042409d3b8e20abaa371838fae853a3ddf9f4e7b61d7167c06046a7381ce3a

  • SSDEEP

    24576:pV2mtR9JIsBWHjnU2TttCrP8rIKDe1z+5IbkNritj:pjv9JIsBWHbpPUhZmIbkNrq

Score
10/10
44caliberspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/878380228894937168/1FKbQhM8XJ4ozljtwifZ-1m-XeYw5uknMJLH4X2t0Qxup8aulmWIgdRLa1z0jAtb9Z9u

Signatures

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7786d92296517e19d9ef43301d5e9683.exe
    "C:\Users\Admin\AppData\Local\Temp\7786d92296517e19d9ef43301d5e9683.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt
    Filesize

    105B

    MD5

    2e9d094dda5cdc3ce6519f75943a4ff4

    SHA1

    5d989b4ac8b699781681fe75ed9ef98191a5096c

    SHA256

    c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

    SHA512

    d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

    Download Submit
  • C:\Users\Admin\AppData\Local\44\Process.txt
    Filesize

    1KB

    MD5

    41fddc7345ac3bfc68c128b8acaea023

    SHA1

    81a3388913b86169bc7ae14b9804e94d2e5c17fe

    SHA256

    48e93378d68b1ef54e848febde79f07c4c77f9ac74a3791db7d968171badbdca

    SHA512

    84a9ac268052403de430c8ca46f2387a12f88c87355ab5e866f8cc5043df39cca30b630b458c23b55540442aeca67d8a1fe6deda1db085ef89b2bd40e9d4a14b

    Download Submit
  • C:\Users\Admin\AppData\Local\44\Process.txt
    Filesize

    245B

    MD5

    0e31df038f9fc7941ae63172d31a9852

    SHA1

    53394ee520e8da715fd73773deb14e4535c6ef69

    SHA256

    8f508d0e48ca5e1b7075fd41da1e6867eff94e0e51b9ec151d3466aac9d5085e

    SHA512

    87194d6014b16c14f559d26edec695eddb745dd80f22bfd165ed44ace48acdb32c7a6931bd9aaeaf3bb24ee058bf1a6779d3a5c130f71addbbbe82fd435304d3

    Download Submit
  • C:\Users\Admin\AppData\Local\44\Process.txt
    Filesize

    402B

    MD5

    a3de1d7d1ca59ee9f82e2e12713e8106

    SHA1

    e30b20fe5cbf743a39bdf88fa12539369fc39f1f

    SHA256

    70e532aa4d713364c2345fd7cf1b03a6f370fb48b019b1b87c4d4171096b3c67

    SHA512

    dae89558891bb65ba86bbe8f71a49c862b227010496a06994538e20c58ae18daca6096d65dec586ad6da07531828644ffe5b084c7b9948c80bf6a3a41429425c

    Download Submit
  • C:\Users\Admin\AppData\Local\44\Process.txt
    Filesize

    843B

    MD5

    b6559cdfe267c632c9232ff3739f800c

    SHA1

    ec7f39055b7f833da120491c42ea18dc0d750904

    SHA256

    2eea42c283e08c4ea7241fe620a208059c321f3c33d66e9b1f15e7777cbf8c35

    SHA512

    85424daa22741678c94cc886ccd731d6d4b8953b4968ff756c1159be72d5502e0f99a0ee0e896f771b8bd488133a4835cb1b73c7c171743a1f98261b600a5725

    Download Submit
  • memory/2700-5-0x0000000006500000-0x0000000006592000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2700-1-0x0000000000680000-0x0000000000A2C000-memory.dmp
    Filesize

    3.7MB

    Download
  • memory/2700-38-0x0000000006F10000-0x00000000074B4000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/2700-127-0x0000000007BE0000-0x0000000007C46000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2700-0-0x0000000000680000-0x0000000000A2C000-memory.dmp
    Filesize

    3.7MB

    Download
  • memory/2700-3-0x0000000000680000-0x0000000000A2C000-memory.dmp
    Filesize

    3.7MB

    Download
  • memory/2700-2-0x0000000073E90000-0x0000000074640000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/2700-4-0x0000000005B10000-0x0000000005B20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2700-131-0x0000000000680000-0x0000000000A2C000-memory.dmp
    Filesize

    3.7MB

    Download
  • memory/2700-132-0x0000000073E90000-0x0000000074640000-memory.dmp
    Filesize

    7.7MB

    Download