Analysis
-
max time kernel
240s -
max time network
275s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-02-2024 15:22
Static task
static1
Behavioral task
behavioral1
Sample
8739059e823d0546bec6151fd4feac47.exe
Resource
win7-20231215-en
General
-
Target
8739059e823d0546bec6151fd4feac47.exe
-
Size
1.2MB
-
MD5
8739059e823d0546bec6151fd4feac47
-
SHA1
84290df98276fae83555efe09b155fe5bac9dd94
-
SHA256
b2fa3170b65e72aaf86c381aef876ea2cd53812a7928d6bd5ee10d9f80a8da1c
-
SHA512
f1f0533f570a9b7c340f6f69850d0a878b0d9ea6ff0170defde96b1df4a5749509b6b826e8de864cdcb376a4549e5382593aaed2e99350bac3295047bfd9bd7a
-
SSDEEP
24576:oRvt2ZygClb0xvqEcS07g6RUChgQpVmSP+HV/mi7LZtj1nGzcgx:oRz0xv9cS0geUopVxO5DLZtpnGzp
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/876771304244662292/PWg2lXTJKRJucms_8CouoIhUP-0bUcNBN7KReSAqvJC9et4O0uOlq-Ft_yf0uJsKO0hO
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 freegeoip.app 5 freegeoip.app -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
8739059e823d0546bec6151fd4feac47.exepid process 2812 8739059e823d0546bec6151fd4feac47.exe 2812 8739059e823d0546bec6151fd4feac47.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
8739059e823d0546bec6151fd4feac47.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 8739059e823d0546bec6151fd4feac47.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 8739059e823d0546bec6151fd4feac47.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8739059e823d0546bec6151fd4feac47.exepid process 2812 8739059e823d0546bec6151fd4feac47.exe 2812 8739059e823d0546bec6151fd4feac47.exe 2812 8739059e823d0546bec6151fd4feac47.exe 2812 8739059e823d0546bec6151fd4feac47.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8739059e823d0546bec6151fd4feac47.exedescription pid process Token: SeDebugPrivilege 2812 8739059e823d0546bec6151fd4feac47.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
8739059e823d0546bec6151fd4feac47.exepid process 2812 8739059e823d0546bec6151fd4feac47.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8739059e823d0546bec6151fd4feac47.exe"C:\Users\Admin\AppData\Local\Temp\8739059e823d0546bec6151fd4feac47.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txtFilesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Roaming\44\Process.txtFilesize
398B
MD533902ac7d158c37b3bb587fbebe5c59a
SHA176d8a676d7ba5f2b7ea27ad334ea2019d5329589
SHA25695a9c5d00bb63ded02f681e79e8a6fbff00c4c6bf7730674154784bbd010b29a
SHA5125d5114de57a28e5515afc8e469748e982fc638cf1320d471f7dad9bff3ee6bd982d42fc6d859af2468b3b0b683d5d35cebcd6a7b0ce16bc3c2a24fca205d6dc4
-
memory/2812-0-0x00000000010B0000-0x000000000145C000-memory.dmpFilesize
3.7MB
-
memory/2812-2-0x00000000010B0000-0x000000000145C000-memory.dmpFilesize
3.7MB
-
memory/2812-3-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/2812-4-0x0000000005350000-0x0000000005390000-memory.dmpFilesize
256KB
-
memory/2812-27-0x00000000010B0000-0x000000000145C000-memory.dmpFilesize
3.7MB
-
memory/2812-58-0x00000000010B0000-0x000000000145C000-memory.dmpFilesize
3.7MB
-
memory/2812-59-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB