44caliber | 4d76bd31c6cb18d229df1ec8fc0c929f37a4cdf694d2c885f1beaeddad3f14d6

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b94b9203b9682e94a0600f8ad2896e59.exe
Size

1.1MB
MD5

b94b9203b9682e94a0600f8ad2896e59
SHA1

f3316cebbc21d9becaa7744f92dc1de6b2ee31ff
SHA256

4d76bd31c6cb18d229df1ec8fc0c929f37a4cdf694d2c885f1beaeddad3f14d6
SHA512

31f0912abcf2b57ad0f8324ff1db0857c619c13f21be2833d0553ee5586ef9fdc9ec1ba16483ff111a7572627ae5c0619da1f08b7096ac454b39e9609b0dc913
SSDEEP

12288:wyLyxYjZb/yKJ4S1ebC68hpaBUZc7U4p12N4IWgswpJRhpQtXjpyECP4WchMMd/J:mwbL4SPX0BecnphaJGqcQla

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 freegeoip.app
9 freegeoip.app

flow	ioc
6	freegeoip.app
9	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b94b9203b9682e94a0600f8ad2896e59.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	b94b9203b9682e94a0600f8ad2896e59.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	b94b9203b9682e94a0600f8ad2896e59.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b94b9203b9682e94a0600f8ad2896e59.exe

pid	process
3180	b94b9203b9682e94a0600f8ad2896e59.exe
3180	b94b9203b9682e94a0600f8ad2896e59.exe
3180	b94b9203b9682e94a0600f8ad2896e59.exe
3180	b94b9203b9682e94a0600f8ad2896e59.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b94b9203b9682e94a0600f8ad2896e59.exe

description pid process

Token: SeDebugPrivilege 3180 b94b9203b9682e94a0600f8ad2896e59.exe

description	pid	process
Token: SeDebugPrivilege	3180	b94b9203b9682e94a0600f8ad2896e59.exe

C:\Users\Admin\AppData\Local\Temp\b94b9203b9682e94a0600f8ad2896e59.exe
"C:\Users\Admin\AppData\Local\Temp\b94b9203b9682e94a0600f8ad2896e59.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
156B

MD5
af44c692fea7bf2ed6a57806204d164f

SHA1
26336fa3334843b14e3bd138107d34b61149a9ea

SHA256
21a7526b1c5ad5057f4b0be073bee6a5d62a64d333e8cb0b7d3edaa870450e49

SHA512
bb530b5761caaf6a43a704969a699cdcf8e147787cad01dc98b30abd97f96562d5e8984ab1a8506588ca8ec19d647aac411b00ea4ae84bb16f684bfd45a6bfad

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
746B

MD5
6a7cc76cb16fe5cccc22336b02b94b90

SHA1
f8173fe9bbcbe92461c476d1c2e700d673b57c2c

SHA256
59b6c74e22eeaefe317c136ec15f4575e4854a69094488a2794e25728b63c56e

SHA512
d0303d42052777502ae73bbc603d33f4e1496d67cbfb62d555afef7c7af74a4055d485b18d60171b53f240f0bb629efb3e8e26f39ce7e12d0bf338faae0742a3

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt
Filesize
1KB

MD5
04a8c391adbcdc1a44e75d6be22f3c50

SHA1
9a988e41aa050cac6e043db986ad032a45e8e824

SHA256
7e683428111c4b63f38acc3f3a6fdfb72f4d9493cb783838b8a2055752420afb

SHA512
e748ad3dfec9ef07f422b854010aef83734d5eb3f1b62bf8b9d8f9c61969173560ecc2ab602bdfafb1fc23509dfb5e7b77894f812dfbe85ad0027fc49e1d0156

Download Submit
memory/3180-0-0x0000000000210000-0x0000000000328000-memory.dmp

Filesize
1.1MB

Download
memory/3180-1-0x0000000000BD0000-0x0000000000BD6000-memory.dmp

Filesize
24KB

Download
memory/3180-2-0x00007FFE1F020000-0x00007FFE1FAE1000-memory.dmp

Filesize
10.8MB

Download
memory/3180-3-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/3180-126-0x00007FFE1F020000-0x00007FFE1FAE1000-memory.dmp

Filesize
10.8MB

Download