44caliber | b2fa3170b65e72aaf86c381aef876ea2cd53812a7928d6bd5ee10d9f80a8da1c

Analysis

max time kernel
144s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8739059e823d0546bec6151fd4feac47.exe
Size

1.2MB
MD5

8739059e823d0546bec6151fd4feac47
SHA1

84290df98276fae83555efe09b155fe5bac9dd94
SHA256

b2fa3170b65e72aaf86c381aef876ea2cd53812a7928d6bd5ee10d9f80a8da1c
SHA512

f1f0533f570a9b7c340f6f69850d0a878b0d9ea6ff0170defde96b1df4a5749509b6b826e8de864cdcb376a4549e5382593aaed2e99350bac3295047bfd9bd7a
SSDEEP

24576:oRvt2ZygClb0xvqEcS07g6RUChgQpVmSP+HV/mi7LZtj1nGzcgx:oRz0xv9cS0geUopVxO5DLZtpnGzp

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/876771304244662292/PWg2lXTJKRJucms_8CouoIhUP-0bUcNBN7KReSAqvJC9et4O0uOlq-Ft_yf0uJsKO0hO

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

29 freegeoip.app
30 freegeoip.app

flow	ioc
29	freegeoip.app
30	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

8739059e823d0546bec6151fd4feac47.exe

pid	process
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8739059e823d0546bec6151fd4feac47.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	8739059e823d0546bec6151fd4feac47.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	8739059e823d0546bec6151fd4feac47.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

8739059e823d0546bec6151fd4feac47.exe

pid	process
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe
3952	8739059e823d0546bec6151fd4feac47.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8739059e823d0546bec6151fd4feac47.exe

description pid process

Token: SeDebugPrivilege 3952 8739059e823d0546bec6151fd4feac47.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8739059e823d0546bec6151fd4feac47.exe

pid process

3952 8739059e823d0546bec6151fd4feac47.exe

description	pid	process
Token: SeDebugPrivilege	3952	8739059e823d0546bec6151fd4feac47.exe

C:\Users\Admin\AppData\Local\Temp\8739059e823d0546bec6151fd4feac47.exe
"C:\Users\Admin\AppData\Local\Temp\8739059e823d0546bec6151fd4feac47.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3952

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
ac835170aa2f3ed957642f9c42012f16

SHA1
c53d2817a09a6ea59e18d53e952409a561d2a976

SHA256
43d44a5b92da9ea65ac8e5a75105402a6bca80f8fb9994c38040b27537e58b38

SHA512
e1fc1124db6cfae4c4de2df774d6c1237316ef2bc9490ca56270a376c80ff621275cc355f04d4aa9a499cb0616967fe46efc53cec7887f6c2b0f523f8c27beca

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
730B

MD5
929d2c413302fe829a79dabbb4201001

SHA1
2c405167d0d878c5097ae68bfc7bd64fd0982788

SHA256
2780b2c60dac0582150187fadde83ca2916ab0d38c4277136333abc33c911ae2

SHA512
809a4f55021a600ff68664329b59d03bb74beb7229fa147d7c03af62010677e535b85dc6097bddeb64d38c433e95be7f02d77d6638a5408ff6bb359d1ccc4763

Download Submit
memory/3952-5-0x0000000000010000-0x00000000003BC000-memory.dmp

Filesize
3.7MB

Download
memory/3952-0-0x0000000000010000-0x00000000003BC000-memory.dmp

Filesize
3.7MB

Download
memory/3952-6-0x00000000060E0000-0x00000000060F0000-memory.dmp

Filesize
64KB

Download
memory/3952-9-0x0000000006BB0000-0x0000000006C42000-memory.dmp

Filesize
584KB

Download
memory/3952-43-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3952-45-0x00000000075C0000-0x0000000007B64000-memory.dmp

Filesize
5.6MB

Download
memory/3952-46-0x00000000060E0000-0x00000000060F0000-memory.dmp

Filesize
64KB

Download
memory/3952-3-0x0000000000010000-0x00000000003BC000-memory.dmp

Filesize
3.7MB

Download
memory/3952-2-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3952-135-0x00000000073C0000-0x0000000007426000-memory.dmp

Filesize
408KB

Download
memory/3952-142-0x0000000000010000-0x00000000003BC000-memory.dmp

Filesize
3.7MB

Download
memory/3952-143-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download