Analysis
-
max time kernel
92s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
26/02/2024, 07:01
General
-
Target
a5b87e5ac2f80812cf19209d42f4efd3.exe
-
Size
544KB
-
MD5
a5b87e5ac2f80812cf19209d42f4efd3
-
SHA1
fa4d5b4a38f469d29d5f193d56a7df0875af2fee
-
SHA256
e1eb28085c40bd7903e9e785c83d7d60e46b01660bb1308d7f631e2297f97257
-
SHA512
aa892db6ea15b8fd73306d78f0bcb3a38da617d04be8019eebb6411b9f9983005b02e0bff8df39b483bf175de3d2fe9442b487987c925ef6e0a57eac235c80f2
-
SSDEEP
12288:dekYQcPFsvcnRjUTZPDnhJ+boEH8TL09MHaWNRKsO:o2vaeZPLxEH86MHaWR
Malware Config
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5b87e5ac2f80812cf19209d42f4efd3.exe"C:\Users\Admin\AppData\Local\Temp\a5b87e5ac2f80812cf19209d42f4efd3.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741B
MD5d5448af1a90d4f3787677088ae270062
SHA1cc1db5eb8174cab6de3e309c057a20247d87fbda
SHA2562be01006ca5e018d5208ea0d3d1822568d5000c6d1376b390628cd07cdecf85e
SHA512d6d0e0c96432538f09493a144bef0a1ccc77571e84004c34609bf0ed4299427249bf9b4ed0a2ea7fa8a949a0444b64c54fb7dfed32d0bb5544f40402b1de75a8
-
Filesize
1KB
MD5caa66fc9ba9263e9cefcead2ded96bcf
SHA12be35eab7228e296fa8d7bb35eac5ae6c8062c1b
SHA256def2d2573d5e58eba6c24739aca34d80452485d2f0e1a1e1a951d14d2a8a640f
SHA512453403616755071a70ad5f7c5535bfb806e3a05ee58177b8af37273059cd2a72db638d44f20040b3b1e261ce9db2433ff02eae35e63a2c53f5ef5d334bf4d91a
-
Filesize
1000KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
10.8MB