44caliber | 49977d7ebceb8b390b44ed50f6447ce0910c9fc73b1bfdd60eef219138d0038e

General

Target

a4849cead4dfa68295a47c5471422ffd.exe
Size

1.5MB
MD5

a4849cead4dfa68295a47c5471422ffd
SHA1

c6c5e9a0a3c37c583def626f9bc227c0c294fa8a
SHA256

49977d7ebceb8b390b44ed50f6447ce0910c9fc73b1bfdd60eef219138d0038e
SHA512

df17c9ecc176bae94aeab4bf5ec6733198e6b961baca50465bce6c2d2acf6cf070ad9b3ed4e6efa64d4beec3d5de24f0cfdcd7ac0c7bd8ddabf810cae324b4a4
SSDEEP

24576:CGR2feTKmUp6t23c51lT9y+wvfH79MPxvvdvOyoldbUzkvdHXFcTjYu8AlmeX5J5:CGR2fnn/3cV8+wvzCxlvOyovbUkITjhV

Score

10^/10

44caliber blackguard spyware stealer

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1818730721:AAGgMZz8w6trwd7tHAnNbu0kJSmYFV_IvXk/sendMessage?chat_id=1610877447

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 freegeoip.app
7 freegeoip.app
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

a4849cead4dfa68295a47c5471422ffd.exe

pid process

112 a4849cead4dfa68295a47c5471422ffd.exe
112 a4849cead4dfa68295a47c5471422ffd.exe

flow	ioc
8	freegeoip.app
7	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a4849cead4dfa68295a47c5471422ffd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	a4849cead4dfa68295a47c5471422ffd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a4849cead4dfa68295a47c5471422ffd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a4849cead4dfa68295a47c5471422ffd.exe

pid	process
112	a4849cead4dfa68295a47c5471422ffd.exe
112	a4849cead4dfa68295a47c5471422ffd.exe
112	a4849cead4dfa68295a47c5471422ffd.exe
112	a4849cead4dfa68295a47c5471422ffd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a4849cead4dfa68295a47c5471422ffd.exe

description pid process

Token: SeDebugPrivilege 112 a4849cead4dfa68295a47c5471422ffd.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a4849cead4dfa68295a47c5471422ffd.exe

pid process

112 a4849cead4dfa68295a47c5471422ffd.exe

description	pid	process
Token: SeDebugPrivilege	112	a4849cead4dfa68295a47c5471422ffd.exe

C:\Users\Admin\AppData\Local\Temp\a4849cead4dfa68295a47c5471422ffd.exe
"C:\Users\Admin\AppData\Local\Temp\a4849cead4dfa68295a47c5471422ffd.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\ProgramData\44\Process.txt
Filesize
1KB

MD5
d82c14b17892e2f20609f75d38cfc421

SHA1
ea2cf47335cb2e4fdacadba2f4b2c15d7222c4ae

SHA256
50539a12b6566296fc4bafd29c6a6d7ebd29078b909559223c0f1b75aba33d6f

SHA512
77872081b40a0129ac2fbf80f10eaf6e9baa0779408a62a03e01ca7f3ce09e90f49a36ee756286d2ae4c517087ae1486da894db33f9985c80a8ee514b3e66d3e

Download Submit
C:\ProgramData\44\Process.txt
Filesize
729B

MD5
edf6ff15fca6b700534efffc89d37f95

SHA1
56508a322c162ee3f56fd58882f3ec1875adaf39

SHA256
5e06323e2c624af82837a0b8584af9f51cca32cd0a279154bba568930dd54c17

SHA512
b34b1a90d90ca18ccc2d37b7ef6b75355b6eb94ed19f4612e92653ab692933b62fc88c6869697ea655d3150f11f6623f6b34973eebbc9d042a7bf4ddf54a49eb

Download Submit
C:\ProgramData\44\Process.txt
Filesize
979B

MD5
1d9af74673b34bfd79567dc138672ac2

SHA1
aef517688f3f3422b77b617120aeb9108271a197

SHA256
b3b195e419adbc438f0018753f5e7fa88f55219b66bcddf9077102236a978e81

SHA512
b6a55c396792f83ac35476c000af89a5313284c8d19c1ff72f97274eee873e2178ef896a059e6f74464fe2f9e60a81c0fbe9a7d6bca8ba09cf4693694eb5f4d2

Download Submit
C:\ProgramData\44\Process.txt
Filesize
1KB

MD5
1ec23161208042e0b37b223b825e4b2d

SHA1
3b6c8821a796794e3fc1ff0ea1006d502b339143

SHA256
c0a890e6963de90eabf8205c002fb16507da0635ea44ad0d652e2322ec40612c

SHA512
063ce778203a8dff92a38e18467077c5bfc38f0908a12fc653bd2d23b78fe953825828a6d43b2284871679d6db2aa9745453215360f760003a73cec62e7e6abf

Download Submit
memory/112-3-0x00000000005E0000-0x0000000000A86000-memory.dmp

Filesize
4.6MB

Download
memory/112-38-0x0000000006C60000-0x0000000006CF2000-memory.dmp

Filesize
584KB

Download
memory/112-39-0x00000000072B0000-0x0000000007854000-memory.dmp

Filesize
5.6MB

Download
memory/112-4-0x0000000003BC0000-0x0000000003BD0000-memory.dmp

Filesize
64KB

Download
memory/112-0-0x00000000005E0000-0x0000000000A86000-memory.dmp

Filesize
4.6MB

Download
memory/112-2-0x0000000074240000-0x00000000749F0000-memory.dmp

Filesize
7.7MB

Download
memory/112-1-0x00000000005E0000-0x0000000000A86000-memory.dmp

Filesize
4.6MB

Download
memory/112-128-0x0000000007140000-0x00000000071A6000-memory.dmp

Filesize
408KB

Download
memory/112-132-0x00000000005E0000-0x0000000000A86000-memory.dmp

Filesize
4.6MB

Download
memory/112-133-0x0000000074240000-0x00000000749F0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing