44caliber | c13b27db146974839ceeb088132e55627944f9a230392e4f8661749586a3626a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Celestial.exe
Size

273KB
MD5

7ca6a26751bd7ad90ffc2843f040117c
SHA1

5c2be81194456480f952d674c0513959eab0ceda
SHA256

c13b27db146974839ceeb088132e55627944f9a230392e4f8661749586a3626a
SHA512

0f16bbf19913c4c09a13ea48325a3751311941b2d6b11a70a97737628c53bd58b8009fa9439e3b0ce66ef0e46dc420a6535b2d8803cbf6669d024c3c4ea3b896
SSDEEP

6144:Of+BLtABPD7sBi/0QNE44FCpHoafTy/lI1D0NiJ:essK44FCpO61DzJ

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	freegeoip.app
5	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Celestial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Celestial.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1592	Celestial.exe
1592	Celestial.exe
1592	Celestial.exe
1592	Celestial.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	Celestial.exe

C:\Users\Admin\AppData\Local\Temp\Celestial.exe
"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
762B

MD5
c787ce5b0cae2567b65d5676490f4964

SHA1
26df43872b0e3065f52cae12c83af2fab0ce02ee

SHA256
c110cf4420b4d8f015467530d33f43d5d6e8de795bccb140693d837c2190052a

SHA512
66e3488af5a445661e787bf9ad7a277060184455ad7f75cc58fc950b48a21c1b719202a3640dec28fbe449c000e4fa988cfda081d1b47f8e36109df903cc5911

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
beeb44dd7ea10a7185613d2ae24f9f33

SHA1
d45f40dccf3153dbf1f580e56281c6d80e0b9e74

SHA256
64363d5ee7605979027233ca2de6e3622bca86c55f1bf243b5c341412dbe963c

SHA512
d2ddd256f8b2d8c87a2df0bfbf6dba27f2c28de462dad7e20446e9b9c88e1e67b94f7bcd30c9ed9f8ffa0eed23efd9aca3058d1cc40bf509a0162aa7e114e27a

Download Submit
memory/1592-0-0x000001ECE3870000-0x000001ECE38BA000-memory.dmp

Filesize
296KB

Download
memory/1592-27-0x00007FFB40090000-0x00007FFB40B51000-memory.dmp

Filesize
10.8MB

Download
memory/1592-31-0x000001ECFDD70000-0x000001ECFDD80000-memory.dmp

Filesize
64KB

Download
memory/1592-125-0x00007FFB40090000-0x00007FFB40B51000-memory.dmp

Filesize
10.8MB

Download