44caliber | 59fa420a36a00183ad4141d16a82d89a9509b5cc0ed4ed53b47fe112f8f6a2df

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8637cc15a564a737a03a5de0480886d.exe
Size

600KB
MD5

c8637cc15a564a737a03a5de0480886d
SHA1

a08a8eca9659e5da8bab754bf0cc2c6836ce165f
SHA256

59fa420a36a00183ad4141d16a82d89a9509b5cc0ed4ed53b47fe112f8f6a2df
SHA512

649633f6a1f984f2782fc78d6ee1d055d7155980ea10614720a7ccb15aee1f263759f0b9ff5e83c9e1e07052cc220ec6f417d3a5f442491bb7b6923f5694cedc
SSDEEP

12288:Xcw9Harlb+VDfYbRlbr+EARQEc/MEtl+HgzQMobSct7VcDqWs:XcTqVDfYbR5rNlt5tl+HHM

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	freegeoip.app
3	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	c8637cc15a564a737a03a5de0480886d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	c8637cc15a564a737a03a5de0480886d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2884	c8637cc15a564a737a03a5de0480886d.exe
2884	c8637cc15a564a737a03a5de0480886d.exe
2884	c8637cc15a564a737a03a5de0480886d.exe
2884	c8637cc15a564a737a03a5de0480886d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	c8637cc15a564a737a03a5de0480886d.exe

C:\Users\Admin\AppData\Local\Temp\c8637cc15a564a737a03a5de0480886d.exe
"C:\Users\Admin\AppData\Local\Temp\c8637cc15a564a737a03a5de0480886d.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
412B

MD5
9ca4a32242418f9a1aac7342a1af4eb3

SHA1
2e3099a112f9206d7d15bea86ba5c91f1f104909

SHA256
9d0161ee0f72fecb00014d7c2868222abc54a7e6b0f791aa1fedd8e2a8cc4e52

SHA512
23387a111660e1e4f550c69e6cf0f63e20c5bcafb9e7da1085c4d5c7207771aef38828e591e0fe53444a23f55b5a800b234e670eea03ce368a94c375b6cd5238

Download Submit
memory/2884-0-0x00000000013E0000-0x0000000001480000-memory.dmp

Filesize
640KB

Download
memory/2884-2-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/2884-1-0x0000000000140000-0x0000000000146000-memory.dmp

Filesize
24KB

Download
memory/2884-3-0x000000001B010000-0x000000001B090000-memory.dmp

Filesize
512KB

Download
memory/2884-4-0x000000001B090000-0x000000001B16E000-memory.dmp

Filesize
888KB

Download
memory/2884-5-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download
memory/2884-52-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download