Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
17-03-2024 01:28
General
-
Target
1fde4c0ddc141022ae31beadbae65aca.exe
-
Size
303KB
-
MD5
1fde4c0ddc141022ae31beadbae65aca
-
SHA1
ad4767a9905590f29e588fde1cd19a124fa42ef4
-
SHA256
59a6f06a6c3fb38fea0456447ef4b2be6c32b66c5eee189df4dcd07b7802cfb6
-
SHA512
b1a8bbc8a876355a6f04b1e40112f1ec1931f3d6bbab7036f87d8661b025310cd854dd789ca19fe8052d003c234ba607f3d5e27581e333b160ad2a833a1d30f1
-
SSDEEP
6144:bb2T6MDdbICydeB4mAQG0yB5cqVsvurTbmI1D0rAC:bb8HAQG0yXcsTR1DVC
Malware Config
Extracted
44caliber
https://discordapp.com/api/webhooks/1218245532355395716/g11t27knevSG81QEKAU9x-8eGlSzRRXTzD3cakygbS3BZNqW4JAN5zponvMiNKqlhNYv
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fde4c0ddc141022ae31beadbae65aca.exe"C:\Users\Admin\AppData\Local\Temp\1fde4c0ddc141022ae31beadbae65aca.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB