Analysis
- max time kernel
143s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
06/03/2024, 05:37
General
- Target b6a21ab39a7778dc807009a9cd23d82c.exe
- Size 943KB
- Sample240306-ga9hpsca91
- SHA256 6723c608be16ce8a8e79c52dfae90c4fefa55b386411ac977d9565e4308c727d
Malware Config
Extracted
-
44caliber
-
https://discord.com/api/webhooks/864993390039138344/KcIraJ14D-c_gxt8b62QhfVu_PGaoIgxX5A9WLR2Iw9WLUoF8VGIsnRR969mXFvP0Unf
Signatures
- 44Caliber
An open source infostealer written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6a21ab39a7778dc807009a9cd23d82c.exe"C:\Users\Admin\AppData\Local\Temp\b6a21ab39a7778dc807009a9cd23d82c.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\Q4efoe5ztW.exe"C:\Users\Admin\AppData\Local\Temp\Q4efoe5ztW.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
Process.txt
Process.txt
Process.txt
Process.txt
Q4efoe5ztW.exe
memory/1768-0-0x0000000000400000-0x00000000006C2000-memory.dmp
memory/1768-43-0x0000000000400000-0x00000000006C2000-memory.dmp
memory/3744-14-0x00000000007D0000-0x000000000081A000-memory.dmp
memory/3744-27-0x00007FFAE2B30000-0x00007FFAE35F1000-memory.dmp
memory/3744-34-0x0000000000F20000-0x0000000000F30000-memory.dmp
memory/3744-143-0x000000001C0B0000-0x000000001C259000-memory.dmp
memory/3744-144-0x00007FFAE2B30000-0x00007FFAE35F1000-memory.dmp