Analysis
-
max time kernel
472s -
max time network
605s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 21:17
General
-
Target
Insidious.exe
-
Size
303KB
-
MD5
1fde4c0ddc141022ae31beadbae65aca
-
SHA1
ad4767a9905590f29e588fde1cd19a124fa42ef4
-
SHA256
59a6f06a6c3fb38fea0456447ef4b2be6c32b66c5eee189df4dcd07b7802cfb6
-
SHA512
b1a8bbc8a876355a6f04b1e40112f1ec1931f3d6bbab7036f87d8661b025310cd854dd789ca19fe8052d003c234ba607f3d5e27581e333b160ad2a833a1d30f1
-
SSDEEP
6144:bb2T6MDdbICydeB4mAQG0yB5cqVsvurTbmI1D0rAC:bb8HAQG0yXcsTR1DVC
Malware Config
Extracted
Family
44caliber
C2
https://discordapp.com/api/webhooks/1218245532355395716/g11t27knevSG81QEKAU9x-8eGlSzRRXTzD3cakygbS3BZNqW4JAN5zponvMiNKqlhNYv
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 freegeoip.app -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Insidious.exepid process 3416 Insidious.exe 3416 Insidious.exe 3416 Insidious.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Insidious.exedescription pid process Token: SeDebugPrivilege 3416 Insidious.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Insidious.exe"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3416-0-0x000001D3AE9F0000-0x000001D3AEA42000-memory.dmpFilesize
328KB
-
memory/3416-11-0x00007FFD60BF0000-0x00007FFD616B1000-memory.dmpFilesize
10.8MB
-
memory/3416-32-0x000001D3C9020000-0x000001D3C9030000-memory.dmpFilesize
64KB
-
memory/3416-33-0x00007FFD60BF0000-0x00007FFD616B1000-memory.dmpFilesize
10.8MB