44caliber | f65ead2486253fc8f1ffb85322d3af078c3f0b59569e3ded89de0f510226015d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6baa421094ae5561400c553c662bd17.exe
Size

253KB
MD5

a6baa421094ae5561400c553c662bd17
SHA1

7b049e54295e2816f33c53304d4b53b8b1a31a27
SHA256

f65ead2486253fc8f1ffb85322d3af078c3f0b59569e3ded89de0f510226015d
SHA512

fbbf4f3f9d3f5ef7e802601b9b125b46e54df1fc6c56ac6a08e98adef0518b2be845655b27d123a68f3647cfb4ce2014f005feeb618facf5bd440d21d1d03b83
SSDEEP

3072:XA7eUAkUo7+CJ+qppsXMpwJBzh3DGcZGGl6tj5rVgLZfzUGWg7w2zp1bCaKdOJ3K:weUAo5TxGJBzlGSGGEZgLxxEuCD

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/875024811489906738/CpyWbrHIQGqh718u5276J6WiFHZNZUgiY72o4Syy8xUjuJKn8uAQ0JGDBq6sXWEbGAnY

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 freegeoip.app
5 freegeoip.app

flow	ioc
4	freegeoip.app
5	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a6baa421094ae5561400c553c662bd17.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	a6baa421094ae5561400c553c662bd17.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a6baa421094ae5561400c553c662bd17.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a6baa421094ae5561400c553c662bd17.exe

pid	process
2572	a6baa421094ae5561400c553c662bd17.exe
2572	a6baa421094ae5561400c553c662bd17.exe
2572	a6baa421094ae5561400c553c662bd17.exe
2572	a6baa421094ae5561400c553c662bd17.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a6baa421094ae5561400c553c662bd17.exe

description pid process

Token: SeDebugPrivilege 2572 a6baa421094ae5561400c553c662bd17.exe

description	pid	process
Token: SeDebugPrivilege	2572	a6baa421094ae5561400c553c662bd17.exe

C:\Users\Admin\AppData\Local\Temp\a6baa421094ae5561400c553c662bd17.exe
"C:\Users\Admin\AppData\Local\Temp\a6baa421094ae5561400c553c662bd17.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
428B

MD5
bad6c5edbfb06dea2ea4a1c411ccb3c4

SHA1
5e62ae3d4362f459408b72a8eb435d43c0f01177

SHA256
3aad45fc031d1db3324569c4f75955ee0366b7d3ad119de1c0378780aec4c757

SHA512
59a342d852e9258730c44578cd4ac218adc8ec0bceb3aac4fa6769293869aee6074346abdd5e493f69be5c66e81ca20daffea5a5565c57e37b1c63f8db2786be

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
e5235740402ade09957953498f5dd44b

SHA1
4ee4a8d39781188816104110d8dd2f27802b0d69

SHA256
1a2ed8e076636c12dc5d6bef137de0e9578f21b2ca6add80a39e3d81bd626f0a

SHA512
638449ca16d64faf066470bafbe136c36245a230737a53416a469008c105e18a487ad14408c0669cdcea742eb7e544b690b1ccd8feb7c77bc1126fe6be0a6363

Download Submit
memory/2572-0-0x0000000000AB0000-0x0000000000AF6000-memory.dmp

Filesize
280KB

Download
memory/2572-3-0x00007FFD5AC10000-0x00007FFD5B6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2572-18-0x000000001B7E0000-0x000000001B7F0000-memory.dmp

Filesize
64KB

Download
memory/2572-123-0x00007FFD5AC10000-0x00007FFD5B6D1000-memory.dmp

Filesize
10.8MB

Download