Analysis
-
max time kernel
92s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06-02-2024 06:35
General
-
Target
940edb1275d4f4590edf64e0889abf61.exe
-
Size
1.2MB
-
MD5
940edb1275d4f4590edf64e0889abf61
-
SHA1
5e699c98a7b9b1d3793611cdc45c560009685c2e
-
SHA256
8b655a359fe66cd0031fa38ec2a03a0dd4b35b2da18684bc8359b4f1fa3fd293
-
SHA512
cd385744913dcb4b7a99854cca69cd61e4b65fdf1463925b0545d8e7e5b454852cc68ae959aa68f4fa69263ec982364ce417f02e834078eb00f27902729000c2
-
SSDEEP
24576:ehiER2uLDwQ9Zs26ZF6Hc2fKWm9is3Y0boUTCJ:cpT3w9rY8qKWj4Y05y
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/879339962309431326/Wo1u0LeBvuiTt_6vlQvfVfGtacXotCWzUOhH9TiugxqILQ5I6innKzyZKFua1L-0k0dx
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\940edb1275d4f4590edf64e0889abf61.exe"C:\Users\Admin\AppData\Local\Temp\940edb1275d4f4590edf64e0889abf61.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
1KB
MD5786f7fd890524afa953ccfac38666133
SHA16f8da2ca26dcae420685f867192c78da0089ca2d
SHA256ce80aaf6943037db79602a31879a1ab67ed211d83f9c1c92c1ca1faf5d066f9f
SHA512ee493132de5aa085acf8bb61426f6fdaed3daf2d9b7c8fc50fe2557574d6031fe1bfd4e4610aa082d11b74ed4f57ac9936df00c8fd263774174ab52e3bee471c
-
Filesize
288B
MD536003acd2c30a6b8b6f81a18963d0a93
SHA1ba4b3f68234c18c17562dfc5d652eb6dc975c3e8
SHA256c58f986e9c2a2e6e265eed072b86c4c4e452fd96dd967bbd2624e34cf1a037ed
SHA512dbd29506c63ae706cc5e1b19c041ecd7e05effa11021b59a132353dc21605b87c0ccb10fd7038cfeb2a29c905127cc1b2802357597be36857769ed641db25424
-
Filesize
729B
MD5844f2d6b23dab454e43a36e9e88641f7
SHA1ba13a82cc8ca15804961c6d1e291475bfabf0cb2
SHA25609a656e8183b08c5ddcafffe25f5cf8431ac4739007c7c19701331986090fea2
SHA51274e9c23ca286b7d5add61e09097d0a7766ebc2cf34bf03a4907b872ba9429aeabe8fb38ea064415be57c02e151f62caf8b2aa17f04ee4b4a380e5c9affd5e251
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
3.7MB
-
Filesize
408KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
7.7MB