Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
05/02/2024, 09:08
General
-
Target
9197890c445e386627b5aecbdb522110.exe
-
Size
601KB
-
MD5
9197890c445e386627b5aecbdb522110
-
SHA1
5b3fcd7d1a7e2b1afef04e8d3983a14632c3260e
-
SHA256
206b5291a89b6a58d48c26bfbc954e793eba213823a2b00d69abd589cc189f02
-
SHA512
c78620ee44a67043f218af3bb2df6edecc8304a7d52a9ca933407d71bb6c858c7eb9eb9219488d1dde8414316dcf9a554e37a391765fb9b27b49726594bae132
-
SSDEEP
12288:x30MeC3c0J1e3IWxxukZFksJlT752pdfUjYSqI2yQfxLrHJT8EnEcouEfRG:x30MeCM+q8QFkiK7I2ZpLrH
Malware Config
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9197890c445e386627b5aecbdb522110.exe"C:\Users\Admin\AppData\Local\Temp\9197890c445e386627b5aecbdb522110.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b77360019317cdc82fed6978f39ac05d
SHA1661804e6aa60f693850c4de7dc185f3af6eafd1e
SHA256254f1aa80eb614d253257999fb33b634fa908d260aabfb2ae8d53fd86c10e472
SHA512a67d2a9d750975b440ffa90b761320f89ec9b31ef3223e7866cc24d4b4fb0534148520d7b849b47bf7687e8e4697bd428820df1cdda9626e5f799c8ef9a43497
-
Filesize
739B
MD5a2eb6b483d9639f8d48127eafaa8873a
SHA1ff99dc9b76eea7304eb80261e249a593cec4d536
SHA2564c6bd2a36464f38056b3435c97ddf8c22d478241da009fcd34b04472ed55cd1d
SHA512312825b05a8ec6134c6de08adab1fdbc6aae7b0059b63b494cd81c96aae0b52e77f8ef11674651f7169976de902335dfbabc502f398f26bc6f2a01a3bdb35473
-
Filesize
1KB
MD566b342c2747bddd0657203cb0919d718
SHA108f597241986d47880eb3f808408aabda66aec04
SHA256ac474507ba345c4fa44957bddf0ddc188897c854b225a983aac39a4df622bbf4
SHA512912ddc4154c2a4ab9a319631cca38bb07a3da6b3b91c292e66650002298e926ee0b3309758a97222960f30845e21e662e0473343bc329eb77c0fc5c8252e5fa2
-
Filesize
640KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
880KB
-
Filesize
24KB
-
Filesize
10.8MB