Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
18/02/2024, 05:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe
Resource
win7-20231215-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target 518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe
- Size 460KB
- Sample240218-gfvlqsfa28
- SHA256 518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818
- MD5 3e5ba25aa4f23ceb11be209d1967e341
- SHA1 c25a05acb5231776456d08fad7df0e48d92931c0
- SHA512 184243d51766bf8d292308e0177046f88e0eb55201eddc9d14670dd3d526c5ed6026c03c88227698670f451f43a3e4f1378f51f2334a9b54d83bb2bc677b0c04
- SSDEEP 6144:jE+yclwQKjdn+WPtYVJIoBfRT+tkbOSeC2xDjAzQeOOg7Y55HkVSGsc:jBdlwHRn+WlYV+8T+tkKC0EEE17HkV8c
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
44caliber
C2
-
https://discord.com/api/webhooks/1199323175729758268/CBdP8e3cXbL0ED8xKBhMw0ikKHmITu-6CI4WjfttZm2aWGZGjp43Msrjwp8AVeEBf6T1
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
resource yara_rule behavioral2/files/0x000700000002312b-6.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/files/0x000700000002312b-12.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/884-14-0x00000227E7EB0000-0x00000227E7F3A000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables Discord URL observed in first stage droppers 3 IoCs
resource yara_rule behavioral2/files/0x000700000002312b-6.dat INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/files/0x000700000002312b-12.dat INDICATOR_SUSPICIOUS_EXE_DiscordURL behavioral2/memory/884-14-0x00000227E7EB0000-0x00000227E7F3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL - Detects executables referencing Discord tokens regular expressions 3 IoCs
resource yara_rule behavioral2/files/0x000700000002312b-6.dat INDICATOR_SUSPICIOUS_EXE_Discord_Regex behavioral2/files/0x000700000002312b-12.dat INDICATOR_SUSPICIOUS_EXE_Discord_Regex behavioral2/memory/884-14-0x00000227E7EB0000-0x00000227E7F3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Discord_Regex - Detects executables referencing credit card regular expressions 3 IoCs
resource yara_rule behavioral2/files/0x000700000002312b-6.dat INDICATOR_SUSPICIOUS_EXE_CC_Regex behavioral2/files/0x000700000002312b-12.dat INDICATOR_SUSPICIOUS_EXE_CC_Regex behavioral2/memory/884-14-0x00000227E7EB0000-0x00000227E7F3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_CC_Regex - Detects executables referencing many VPN software clients. Observed in infosteslers 3 IoCs
resource yara_rule behavioral2/files/0x000700000002312b-6.dat INDICATOR_SUSPICIOUS_EXE_References_VPN behavioral2/files/0x000700000002312b-12.dat INDICATOR_SUSPICIOUS_EXE_References_VPN behavioral2/memory/884-14-0x00000227E7EB0000-0x00000227E7F3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_VPN - Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 3 IoCs
resource yara_rule behavioral2/files/0x000700000002312b-6.dat INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/files/0x000700000002312b-12.dat INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/884-14-0x00000227E7EB0000-0x00000227E7F3A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 232 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe - Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe 3.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe 3.exe - Executes dropped EXE 2 IoCs
pid Process 884 1.exe 2288 3.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9902b29d6de7130c2f409ab27fb09fa7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3.exe\" .." 3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9902b29d6de7130c2f409ab27fb09fa7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3.exe\" .." 3.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 freegeoip.app 8 freegeoip.app - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 884 1.exe 884 1.exe 884 1.exe 884 1.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe 2288 3.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2288 3.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 884 1.exe Token: SeDebugPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe Token: 33 2288 3.exe Token: SeIncBasePriorityPrivilege 2288 3.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4704 wrote to memory of 884 4704 518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe 83 PID 4704 wrote to memory of 884 4704 518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe 83 PID 4704 wrote to memory of 2288 4704 518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe 85 PID 4704 wrote to memory of 2288 4704 518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe 85 PID 4704 wrote to memory of 2288 4704 518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe 85 PID 2288 wrote to memory of 232 2288 3.exe 89 PID 2288 wrote to memory of 232 2288 3.exe 89 PID 2288 wrote to memory of 232 2288 3.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe"C:\Users\Admin\AppData\Local\Temp\518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:884
-
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3.exe" "3.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:232
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\44\Process.txt
- Size 700B
- SHA256 75f0a24def355fcf3a302e72cc086a9d05e8754bdbcf71e418031751356ec3d3
- MD5 da3fde1fbda42ae91ccd9c950024dfb1
- SHA1 c0e8e86feabb22cc2c9f4a989156418eaa4f94d6
- SHA512 99cececd0ce3b6a5e9a10fdba960afc8053af79624d7f583f9157ac3b0ca1f471304384df418217a16b9f6bde91f6477a336ece8700e24a7ff241a1e75e6b09a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\44\Process.txt
- Size 1KB
- SHA256 ca866de7d5d78af3510476649d7bd769524d110c0307547c5406932813ffc97a
- MD5 2ac7e51695c747cb64c4857b8e937406
- SHA1 6932f47cd2d6542f49597d3524f22a33eeffca42
- SHA512 e311d152649a52ababb3e54d7149537ce21a1c5d5aea4a6369d79cb02c161e9663835bbb5d8676cefb07faca2ed51092d26328446e3177346c37803ed62f8637
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\1.exe
- Size 534KB
- SHA256 5ac29f18472f943f2eb3c256fdbfe251b04ca66afc22fcba65183b0509feb529
- MD5 0ce3051b867d50aa172d1b332f156e3e
- SHA1 f87defe312cb3a5efea3f845d187762e153bddab
- SHA512 5169a3acd3c79cc4d22bf3a1f4d9770797d2c31503bab1022a153ad56c382e495de2ce06a8a04b3bb4b2fb2c666575dcdefa26533ff5affc4b6ce126e2166193
- SSDEEP 6144:ef+BLtABPDLgj1xw1eO5rbMMzhgUsYqTXGG/5zJRb2IXe05f4VGWWxjdq:d161eO5rbHHsYqTXGOXXe+4k8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1.exe
- Size 308KB
- SHA256 63183189ec9ffe050cf7365bff0bf62d7c7e4218ce0ebd1a20ed85405a2a7d72
- MD5 cb44cb64513abb0ab881098dfdd5e516
- SHA1 99077ea69d4a00d65fdeaf13d16d9be6702da8ce
- SHA512 8ec53b98b38bce690dfd2ca032cb2d51e5a0b5b72e7ec79c4c7dc0044e8726a828fe6d7a985ea6b20e55f4326b07961c958ee2561d12530b8863472f5ce2841c
- SSDEEP 6144:ef+BLtABPDLgj1xw1eO5rbMMzhgUsYqTXGG/5zJRb2IXe05f4:d161eO5rbHHsYqTXGOXXe+4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3.exe
- Size 37KB
- SHA256 4c690a994e22eb6aa31af6e552b610ea1ff01ac58622d56232ad6e820c2aa414
- MD5 6d11195af6cca04eb53eccf9aaf329dc
- SHA1 85f70d6fcff5212649deaf1d18e66d563727c186
- SHA512 76a59b8164a478691d14be7e5d002280ec5453cb6d9f73387ad45e49755d03927f3814c42df987a4dc61c942e9e7b25ab9559651981020bf53ad56a8e4e65c8b
- SSDEEP 384:K+xcaCisP/WRdL5kyc/5kvHHng6sZ8prAF+rMRTyN/0L+EcoinblneHQM3epzX6r:nxckD5nc/5k/VscrM+rMRa8NuU5t
- MD5 SHA1 SHA512 SSDEEP