44caliber | 26f829868cd841f2da691689045c28b308e1f1c21d5af129c8216dd3cc5a0476

Analysis

max time kernel
93s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ONETAP V4 CRACK.exe
Size

274KB
MD5

31732d9535ba2bdb12beeb40a75790de
SHA1

7cce72d5128f33f2a9e894c58d353472bcef27a9
SHA256

26f829868cd841f2da691689045c28b308e1f1c21d5af129c8216dd3cc5a0476
SHA512

705b2a04a5d8afcff83e78fe2daf8adfd9e0e6b146c1799f4b1bd7923fe206cda5ebc6af8a33fb6198c154097e2e1af58f7fb56d1199ad2077afac33edea0302
SSDEEP

6144:xf+BLtABPDpFJAKXYSlrLirJbz3ORA1D0qaR:vFKSlrLiBz1D0R

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/922044577169424395/qwAEIr00IbMp6PeuupxU_XupCXhK82a_lw1-3gBrRFMHaRsff_21yyAHBlGdXbxpacQ_

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	freegeoip.app
7	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ONETAP V4 CRACK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	ONETAP V4 CRACK.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3924	ONETAP V4 CRACK.exe
3924	ONETAP V4 CRACK.exe
3924	ONETAP V4 CRACK.exe
3924	ONETAP V4 CRACK.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	ONETAP V4 CRACK.exe

C:\Users\Admin\AppData\Local\Temp\ ONETAP V4 CRACK.exe
"C:\Users\Admin\AppData\Local\Temp\ ONETAP V4 CRACK.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
739B

MD5
769931470d4c3c83a5c0ad3d10c34ab3

SHA1
d388aadce157e64cf95db08d4507b4e8eb635def

SHA256
039864c6d59150b6a2617354f983d1f3dccd70988cca6e03e8dbbb6961d15052

SHA512
8a02fde21843951eb26ec1e8c2ff9b8da93caaa9a6dcecc334367a6a04a21d4061e695516a388fba9a01f5a3d04c70dc6d2361e6bae80eb6720848071741b4ad

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
1KB

MD5
8561cb163424d7b1fa823afbf05c157d

SHA1
14a5f5e87a341d5663808395017c63c047853f85

SHA256
9bf2e3018dc75dbe50f061a4b027fabb3105c214f79e7c6b9531ab92497a79f4

SHA512
5052585764f315a2ff2d17da2361a2eb2432808580bf2ad18eec2c2288d2e101d048776d432e9fac87478ff03349a3c2698b86e9064f1adfe364cf6e1e1535ba

Download Submit
memory/3924-0-0x0000000000BC0000-0x0000000000C0A000-memory.dmp

Filesize
296KB

Download
memory/3924-10-0x00007FFCF2710000-0x00007FFCF31D1000-memory.dmp

Filesize
10.8MB

Download
memory/3924-11-0x000000001B9B0000-0x000000001B9C0000-memory.dmp

Filesize
64KB

Download
memory/3924-120-0x000000001C530000-0x000000001C6D9000-memory.dmp

Filesize
1.7MB

Download
memory/3924-121-0x00007FFCF2710000-0x00007FFCF31D1000-memory.dmp

Filesize
10.8MB

Download