Analysis
-
max time kernel
140s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
05-02-2024 06:23
General
-
Target
914350a00cb299d2807c459fd950e750.exe
-
Size
495KB
-
MD5
914350a00cb299d2807c459fd950e750
-
SHA1
8df271a04e4e45e1e6210f1f01b517d71b9236f4
-
SHA256
228ee56c9ca55a911f1c0789b58050e408d14a7fbc21bb1ef3a41426a2dae840
-
SHA512
d15f3d2914c28561e4b5f2466f3651e4eba7d175dd76d9232923dccf7d4abf154670991d74c5949c8fe79349808b834ffde8e5833b20ca8d09e955504ad08a06
-
SSDEEP
6144:dfptJNaTZTXr1u3P55Z9JZ1145i4Hw6a3eOU3gkWtXP6x08lZO8oLCGRcgi6Ov4W:dfpts7hiL9JZ1KB/dDgyHZoLM6zG
Malware Config
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\914350a00cb299d2807c459fd950e750.exe"C:\Users\Admin\AppData\Local\Temp\914350a00cb299d2807c459fd950e750.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD551f0ffff42f158fd24da03c39ad6b952
SHA13a4d0a58e37551f05757569b4f317343cfd1056b
SHA256e9d825b136157181385987f4485956cab627bd3e0ccf6c03fa75a248ee969559
SHA51207f1925886987775617faf15ebca9fe0c5b47c497d6f74b3632a379fc99044ccec46058597c2f3663fdc9a6176f9291c620c21c275d4a612a88d95cda2515796
-
Filesize
936KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.8MB