44caliber | d963729366502cb3aa25b180774331bbc36505388b9a88e18de5c1e31bb22c44

General

Target

874dad172d7d4af0bab54a7a5b7dc6a7.exe
Size

1.7MB
MD5

874dad172d7d4af0bab54a7a5b7dc6a7
SHA1

26917510b8f15642cf6ded5281ee4f364366ede1
SHA256

d963729366502cb3aa25b180774331bbc36505388b9a88e18de5c1e31bb22c44
SHA512

be2744820aad996309429fec956d04ffaa34deea3f539406d19a7ab8119948b5ddc90a4a7febb69cac8aefde164aaa6868c15d35932af0032784883e2195ea4c
SSDEEP

49152:QtgXScc+ckmtEs4MMrb1NpN95VDLTwNAjg:9i+Xm2BMu/nX

Score

10^/10

44caliber blackguard spyware stealer

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1942918979:AAFYbo4y_dydty9_QVi9q57Nc95ysGNQ3N0/sendMessage?chat_id=1346139054

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 freegeoip.app
6 freegeoip.app

flow	ioc
3	freegeoip.app
6	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

874dad172d7d4af0bab54a7a5b7dc6a7.exe

pid	process
1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe
1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe
1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe
1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

874dad172d7d4af0bab54a7a5b7dc6a7.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	874dad172d7d4af0bab54a7a5b7dc6a7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	874dad172d7d4af0bab54a7a5b7dc6a7.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

874dad172d7d4af0bab54a7a5b7dc6a7.exe

pid	process
1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe
1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe
1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe
1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

874dad172d7d4af0bab54a7a5b7dc6a7.exe

description pid process

Token: SeDebugPrivilege 1156 874dad172d7d4af0bab54a7a5b7dc6a7.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

874dad172d7d4af0bab54a7a5b7dc6a7.exe

pid process

1156 874dad172d7d4af0bab54a7a5b7dc6a7.exe

description	pid	process
Token: SeDebugPrivilege	1156	874dad172d7d4af0bab54a7a5b7dc6a7.exe

C:\Users\Admin\AppData\Local\Temp\874dad172d7d4af0bab54a7a5b7dc6a7.exe
"C:\Users\Admin\AppData\Local\Temp\874dad172d7d4af0bab54a7a5b7dc6a7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1156

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
4d60d3c341a12200e9de77fc5a337bf9

SHA1
d934712f62fcca8215bfb8ab4d449d3432a1c55b

SHA256
f76af31a5d48d1450e7d5b531039dcb4bc2c472b4587809e4d121e538351eba0

SHA512
6dc0965d90e62e5c80e6f40ad226ef7641689e790f1e5b8891ae39b60591514ecfefa91a606f0622ab101dc24b956e28cab89bccdd6b4e1c27644e828d103308

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
297B

MD5
1949ea72d021937c04e0aca07fd03d75

SHA1
584524691f8290b96af6c7a4e16d27d682382495

SHA256
a120827eb27914c0957895c7f574149fb15eb875fd375a7691f5a4a6a8b1c84e

SHA512
e078929431198e65e986b6eceee6e17a23e6a34d4bc6a25042cbb2db1175e720f311d571904b3cf70106de6bc93bc2ac765d54bb5a781f814db074c8cf1aff8b

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
666B

MD5
ee9cb602f638368a40b20f85df26d384

SHA1
1b1c0f39562edf6825b7cbbaab5e48c1f4736b4e

SHA256
bc2eb155ea85ff6fbb597eb1024d6f853698082436afe5efe8476c8cbd5b2cb0

SHA512
1da1c618348fc84992042ec45df5eca8ab4c660a05cddca6b1136ef2c5d65b5824ac6259887d3aa201a5ddf1a21944d35f2f910f899242f500557a7a5a352bf4

Download Submit
memory/1156-159-0x0000000073EC0000-0x0000000074670000-memory.dmp

Filesize
7.7MB

Download
memory/1156-142-0x0000000006610000-0x0000000006618000-memory.dmp

Filesize
32KB

Download
memory/1156-38-0x0000000006AA0000-0x0000000006B32000-memory.dmp

Filesize
584KB

Download
memory/1156-39-0x00000000070F0000-0x0000000007694000-memory.dmp

Filesize
5.6MB

Download
memory/1156-4-0x0000000005C80000-0x0000000005C90000-memory.dmp

Filesize
64KB

Download
memory/1156-1-0x0000000000670000-0x0000000000B52000-memory.dmp

Filesize
4.9MB

Download
memory/1156-3-0x0000000000670000-0x0000000000B52000-memory.dmp

Filesize
4.9MB

Download
memory/1156-2-0x0000000073EC0000-0x0000000074670000-memory.dmp

Filesize
7.7MB

Download
memory/1156-126-0x0000000007070000-0x00000000070D6000-memory.dmp

Filesize
408KB

Download
memory/1156-141-0x0000000006600000-0x000000000660A000-memory.dmp

Filesize
40KB

Download
memory/1156-143-0x0000000006670000-0x0000000006692000-memory.dmp

Filesize
136KB

Download
memory/1156-144-0x00000000076A0000-0x00000000079F4000-memory.dmp

Filesize
3.3MB

Download
memory/1156-147-0x0000000000670000-0x0000000000B52000-memory.dmp

Filesize
4.9MB

Download
memory/1156-149-0x0000000073EC0000-0x0000000074670000-memory.dmp

Filesize
7.7MB

Download
memory/1156-158-0x0000000000670000-0x0000000000B52000-memory.dmp

Filesize
4.9MB

Download
memory/1156-0-0x0000000000670000-0x0000000000B52000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads