44caliber | 3baba0e5ac69f265b2b01a091ffd6a39b27c1cd897337d6dfe5bb08643c7c619

General

Target

b344cae600dfbd1b6128308fb5dd0902.exe
Size

1.7MB
MD5

b344cae600dfbd1b6128308fb5dd0902
SHA1

454e8ff06373b2faf985afd03faa68bfcf558b30
SHA256

3baba0e5ac69f265b2b01a091ffd6a39b27c1cd897337d6dfe5bb08643c7c619
SHA512

5404eb514b8d861dcc84577163bd0f861809e8bc53e2ca6444ff142263ab170b30de48d321ff17d293b51888269c954424cde31c170c39cc4c031693fc2c85b7
SSDEEP

49152:ArxVV0DLYe8UTCEhVMrVKFJnSw46ezzkp5a4XAtF5ijsyU4Cof:KVVvLUGSWMvSw46eM5jXK+jsH

Score

10^/10

44caliber blackguard spyware stealer

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1949371393:AAHUhcBi4jT-n7M-0jdnFN7sSCcZev8Wgv8/sendMessage?chat_id=578325291

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 freegeoip.app
8 freegeoip.app

flow	ioc
7	freegeoip.app
8	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

Processes:

b344cae600dfbd1b6128308fb5dd0902.exe

pid	process
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b344cae600dfbd1b6128308fb5dd0902.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	b344cae600dfbd1b6128308fb5dd0902.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	b344cae600dfbd1b6128308fb5dd0902.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b344cae600dfbd1b6128308fb5dd0902.exe

pid	process
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe
2868	b344cae600dfbd1b6128308fb5dd0902.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b344cae600dfbd1b6128308fb5dd0902.exe

description pid process

Token: SeDebugPrivilege 2868 b344cae600dfbd1b6128308fb5dd0902.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b344cae600dfbd1b6128308fb5dd0902.exe

pid process

2868 b344cae600dfbd1b6128308fb5dd0902.exe

description	pid	process
Token: SeDebugPrivilege	2868	b344cae600dfbd1b6128308fb5dd0902.exe

C:\Users\Admin\AppData\Local\Temp\b344cae600dfbd1b6128308fb5dd0902.exe
"C:\Users\Admin\AppData\Local\Temp\b344cae600dfbd1b6128308fb5dd0902.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
872B

MD5
f62c21e21c75f99a066372436dec7f15

SHA1
31a90b2d6515894722f9e6c0bd6a0736e6620e78

SHA256
7b911582575df60cf5757231359c5af5ff9c65847e2bd85711dc39cf69ca7421

SHA512
f39c7181830895d84ef79f93c6e3a8c3a603da08e29cd136e39f67b270da50843a12dc35d3bea1d8029ab1df0ab9d6dd28fb4e5d59f8e1d0982910eec25f4447

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
1KB

MD5
338b26f507316b11b4115bed1c516332

SHA1
382d04edda911593c23f47aeca9cdf47399dce36

SHA256
f7b2876e43103f3144efc05836ee26e6592bc4d7097adcc74b8fb7b3cff71098

SHA512
b56a4eb983131cd5251f83684138765770bbb5dd88b10d274ec7b997baa0b01f8216620d84c99a7dd365f6843fb7cbe9fd1afba0397a862e261235881b1f4306

Download Submit
memory/2868-132-0x00000000074D0000-0x0000000007536000-memory.dmp

Filesize
408KB

Download
memory/2868-151-0x0000000007D30000-0x0000000007D38000-memory.dmp

Filesize
32KB

Download
memory/2868-38-0x0000000006F30000-0x0000000006FC2000-memory.dmp

Filesize
584KB

Download
memory/2868-39-0x0000000007580000-0x0000000007B24000-memory.dmp

Filesize
5.6MB

Download
memory/2868-2-0x0000000073D40000-0x00000000744F0000-memory.dmp

Filesize
7.7MB

Download
memory/2868-0-0x0000000000180000-0x0000000000662000-memory.dmp

Filesize
4.9MB

Download
memory/2868-1-0x0000000000180000-0x0000000000662000-memory.dmp

Filesize
4.9MB

Download
memory/2868-150-0x0000000006B80000-0x0000000006B8A000-memory.dmp

Filesize
40KB

Download
memory/2868-3-0x0000000006300000-0x0000000006310000-memory.dmp

Filesize
64KB

Download
memory/2868-152-0x0000000007D90000-0x0000000007DB2000-memory.dmp

Filesize
136KB

Download
memory/2868-153-0x0000000007DC0000-0x0000000008114000-memory.dmp

Filesize
3.3MB

Download
memory/2868-155-0x0000000000180000-0x0000000000662000-memory.dmp

Filesize
4.9MB

Download
memory/2868-157-0x0000000073D40000-0x00000000744F0000-memory.dmp

Filesize
7.7MB

Download
memory/2868-175-0x0000000000180000-0x0000000000662000-memory.dmp

Filesize
4.9MB

Download
memory/2868-176-0x0000000073D40000-0x00000000744F0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads