44caliber | 4d4c6e971e2c8635ffdcc310998c0ab3b72595cc6589754666554da4128c4862

Analysis

max time kernel
56s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Akebi/Akebi.exe
Size

274KB
MD5

6c10aa7f40c68f01050d041ab9c16417
SHA1

8b447164852a63f79e276396649f98dfb955e053
SHA256

db5cda1822fc9fa50bc6719d835d61692d936b674da3d840ba61ad1b11c616eb
SHA512

9636f49c03203faf53e48945efb3e182ddbcbd143822f7c706d11164d2a1a7e86caa72d3eabf307616011b79fb00b35a894dc6055a2d1cfa9966183e96a12a31
SSDEEP

6144:Bf+BLtABPDMZZzIlzcwKUfmBnxafTy8lI1D0zOy:uZOnKUfmBXx1DNy

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1205378577210548224/LNcoZrLKPyHLEN4pcKhtXlPWyk5g8jRNtbvhK_L1UGxjObYKgJwFG53LqgVJZWP5xjst

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 freegeoip.app
24 freegeoip.app

flow	ioc
23	freegeoip.app
24	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Akebi.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Akebi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Akebi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Akebi.exe

pid process

676 Akebi.exe
676 Akebi.exe
676 Akebi.exe
676 Akebi.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Akebi.exe

description pid process

Token: SeDebugPrivilege 676 Akebi.exe

pid	process
676	Akebi.exe
676	Akebi.exe
676	Akebi.exe
676	Akebi.exe

description	pid	process
Token: SeDebugPrivilege	676	Akebi.exe

C:\Users\Admin\AppData\Local\Temp\Akebi\Akebi.exe
"C:\Users\Admin\AppData\Local\Temp\Akebi\Akebi.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
1KB

MD5
19aed0132fce75f93f4de3a50775f30a

SHA1
93e04ec9c19abc64ad6fea3eb658bc0584c0dc7f

SHA256
2579c985b5539f9a52d0af78e104f79a994d4382cd0cea6ff94cb44e3f4d1aa2

SHA512
fc7a8e04f2cc267abb1febad34f2e3d9f3b106c49834c87e138a01639162b3bddf50d628f31e13a07c073731f88e20cc99a3bf8d64758fc7e1e83c0a8f996750

Download Submit
memory/676-0-0x000002A0C7940000-0x000002A0C798A000-memory.dmp

Filesize
296KB

Download
memory/676-31-0x00007FFF327A0000-0x00007FFF33261000-memory.dmp

Filesize
10.8MB

Download
memory/676-32-0x000002A0C7DE0000-0x000002A0C7DF0000-memory.dmp

Filesize
64KB

Download
memory/676-120-0x00007FFF327A0000-0x00007FFF33261000-memory.dmp

Filesize
10.8MB

Download