44caliber | fb36313cba2e5e967fa201a8317176af31782119fc5d6b022c1c68c5996da8ee

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4c197aa74ab1aa8eb19e9f750643983.exe
Size

844KB
MD5

b4c197aa74ab1aa8eb19e9f750643983
SHA1

fe4319509145df64949c4cd9d18185a9a04e8633
SHA256

fb36313cba2e5e967fa201a8317176af31782119fc5d6b022c1c68c5996da8ee
SHA512

a7cbe83a1b9f10595cfd8f542078e8230a9576935e9caa341f824fcc18bfd3eb6f2bedcb52683f88de6dcc7fc5573a72cbb4c1c9440c1cfede37c43b2f3a6fa3
SSDEEP

12288:DmgwBRrWBuAYXe4/DJHXdziAreAjIETFrcfEOnR4nCSEmZh012EH5K9gJy5aAWdY:DmgwHW0AYvVXdzGETFI39J1q

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 freegeoip.app
9 freegeoip.app

flow	ioc
5	freegeoip.app
9	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b4c197aa74ab1aa8eb19e9f750643983.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	b4c197aa74ab1aa8eb19e9f750643983.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	b4c197aa74ab1aa8eb19e9f750643983.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b4c197aa74ab1aa8eb19e9f750643983.exe

pid	process
1608	b4c197aa74ab1aa8eb19e9f750643983.exe
1608	b4c197aa74ab1aa8eb19e9f750643983.exe
1608	b4c197aa74ab1aa8eb19e9f750643983.exe
1608	b4c197aa74ab1aa8eb19e9f750643983.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b4c197aa74ab1aa8eb19e9f750643983.exe

description pid process

Token: SeDebugPrivilege 1608 b4c197aa74ab1aa8eb19e9f750643983.exe

description	pid	process
Token: SeDebugPrivilege	1608	b4c197aa74ab1aa8eb19e9f750643983.exe

C:\Users\Admin\AppData\Local\Temp\b4c197aa74ab1aa8eb19e9f750643983.exe
"C:\Users\Admin\AppData\Local\Temp\b4c197aa74ab1aa8eb19e9f750643983.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt
Filesize
732B

MD5
de7f00bb7d652aa8e71aafc1c6eabf22

SHA1
fbe38847b85b9b834efdb2af0c06bb12d61e8461

SHA256
06f94ba7a4e3f2101f5a63138ed75c57988ca05710858e43f77442f21444c9b6

SHA512
349c5ce6f5cc1cb380a15cb2486437108e4cd86028184fd1740c59c79afda7f05a7e5f7f17471006fffc7d550b8440181ce3e9b9243f0cdb989da43d925f30aa

Download Submit
C:\ProgramData\44\Process.txt
Filesize
1KB

MD5
c7cc1987a4f7e2f25f428f8dd522ab6d

SHA1
80dea026e7c2a95b9363e4f209bc139eb4c0d267

SHA256
8021e1d0bd1f90bf4504acc0194c176969268de991157c16773fb92564b3fb71

SHA512
ab91e58bdd3709899626a37460fa7de656f96cd0ba5cfba2a56436e662da84138b35e5457f165c6963a31f966954d97c8000f54804d7eacc4b755653c961d748

Download Submit
memory/1608-0-0x0000000000B90000-0x0000000000C6C000-memory.dmp

Filesize
880KB

Download
memory/1608-1-0x0000000001410000-0x0000000001416000-memory.dmp

Filesize
24KB

Download
memory/1608-4-0x00007FFC1AA40000-0x00007FFC1B501000-memory.dmp

Filesize
10.8MB

Download
memory/1608-13-0x000000001B9E0000-0x000000001B9F0000-memory.dmp

Filesize
64KB

Download
memory/1608-124-0x00007FFC1AA40000-0x00007FFC1B501000-memory.dmp

Filesize
10.8MB

Download