44caliber | 59fa420a36a00183ad4141d16a82d89a9509b5cc0ed4ed53b47fe112f8f6a2df

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8637cc15a564a737a03a5de0480886d.exe
Size

600KB
MD5

c8637cc15a564a737a03a5de0480886d
SHA1

a08a8eca9659e5da8bab754bf0cc2c6836ce165f
SHA256

59fa420a36a00183ad4141d16a82d89a9509b5cc0ed4ed53b47fe112f8f6a2df
SHA512

649633f6a1f984f2782fc78d6ee1d055d7155980ea10614720a7ccb15aee1f263759f0b9ff5e83c9e1e07052cc220ec6f417d3a5f442491bb7b6923f5694cedc
SSDEEP

12288:Xcw9Harlb+VDfYbRlbr+EARQEc/MEtl+HgzQMobSct7VcDqWs:XcTqVDfYbR5rNlt5tl+HHM

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	freegeoip.app
18	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	c8637cc15a564a737a03a5de0480886d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	c8637cc15a564a737a03a5de0480886d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1896	c8637cc15a564a737a03a5de0480886d.exe
1896	c8637cc15a564a737a03a5de0480886d.exe
1896	c8637cc15a564a737a03a5de0480886d.exe
1896	c8637cc15a564a737a03a5de0480886d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	c8637cc15a564a737a03a5de0480886d.exe

C:\Users\Admin\AppData\Local\Temp\c8637cc15a564a737a03a5de0480886d.exe
"C:\Users\Admin\AppData\Local\Temp\c8637cc15a564a737a03a5de0480886d.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
ee7f7c5b2b2ff69d0a742f05777dde29

SHA1
b0a7b8246d95ab370e1b6778cdb638d3b201fa07

SHA256
cbb81f7910a4ced21afc94492c7a5578c35e99abc3ba3453f8b2d47fd9d23dfc

SHA512
1b9cae6da045e493808658008cf9e97f2c4236fa860a7a19d234d51a895f9e7f7d005c1f40af60fae004750d4c432828e83b0b2e96eee6e18910bcd3f79d30c9

Download Submit
memory/1896-0-0x00000000000C0000-0x0000000000160000-memory.dmp

Filesize
640KB

Download
memory/1896-1-0x00007FF9C1DE0000-0x00007FF9C28A1000-memory.dmp

Filesize
10.8MB

Download
memory/1896-2-0x0000000000900000-0x0000000000906000-memory.dmp

Filesize
24KB

Download
memory/1896-3-0x000000001AD80000-0x000000001AD90000-memory.dmp

Filesize
64KB

Download
memory/1896-4-0x000000001B050000-0x000000001B12E000-memory.dmp

Filesize
888KB

Download
memory/1896-5-0x0000000000910000-0x0000000000916000-memory.dmp

Filesize
24KB

Download
memory/1896-126-0x00007FF9C1DE0000-0x00007FF9C28A1000-memory.dmp

Filesize
10.8MB

Download