44caliber | fa6eae73527d0fe9a5b011b225d21ea71f7d8363e57de3347ebb817ed3b43443

General

Target

df61aa9b6626a6aed2da2edc8a33f0e5.exe
Size

971KB
MD5

df61aa9b6626a6aed2da2edc8a33f0e5
SHA1

1d493fa7505b140d4c13b66486b86c332bd96396
SHA256

fa6eae73527d0fe9a5b011b225d21ea71f7d8363e57de3347ebb817ed3b43443
SHA512

4989dba701959001a0f6e14053ebe9838e0350e7140fd7c96cccefc75f75aa77338bdce80ef1c5b98c8b3bc459a195c889925ae41ffeac9c8cc78050fcb0a30e
SSDEEP

12288:sVyHqncOUXqqX6msZ1nTsIVqaa5F1Amx412JbUK4peOMnIKxJZzW4Jt4E2Tl+W+a:8GaqKXV63AmPpHD4E2TldgbkIN8n5+

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/851720137627009024/ahknPC8imWvV4KcSh6Pzb2POT7YkDJJSBxYH61AmAlhvLe5Og1WX7lD9MRr3-Nj1cRu3

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	df61aa9b6626a6aed2da2edc8a33f0e5.exe

Executes dropped EXE 1 IoCs

pid	Process
4468	物商物望家她.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	freegeoip.app
36	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4468 set thread context of 3608	4468	物商物望家她.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3608	MSBuild.exe
3608	MSBuild.exe
3608	MSBuild.exe
3608	MSBuild.exe
3608	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	df61aa9b6626a6aed2da2edc8a33f0e5.exe
Token: SeDebugPrivilege	4468	物商物望家她.exe
Token: SeDebugPrivilege	3608	MSBuild.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4468	4540	df61aa9b6626a6aed2da2edc8a33f0e5.exe	97
PID 4540 wrote to memory of 4468	4540	df61aa9b6626a6aed2da2edc8a33f0e5.exe	97
PID 4468 wrote to memory of 3608	4468	物商物望家她.exe	99
PID 4468 wrote to memory of 3608	4468	物商物望家她.exe	99
PID 4468 wrote to memory of 3608	4468	物商物望家她.exe	99
PID 4468 wrote to memory of 3608	4468	物商物望家她.exe	99
PID 4468 wrote to memory of 3608	4468	物商物望家她.exe	99
PID 4468 wrote to memory of 3608	4468	物商物望家她.exe	99
PID 4468 wrote to memory of 3608	4468	物商物望家她.exe	99
PID 4468 wrote to memory of 3608	4468	物商物望家她.exe	99

C:\Users\Admin\AppData\Local\Temp\df61aa9b6626a6aed2da2edc8a33f0e5.exe
"C:\Users\Admin\AppData\Local\Temp\df61aa9b6626a6aed2da2edc8a33f0e5.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\物商物望家她.exe
  "C:\Users\Admin\AppData\Local\Temp\物商物望家她.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
4853e1967dba6fdfd339782f95b7104d

SHA1
30be78ff4a4f2f33e4f5219793cfe7406cd497b9

SHA256
0bca37eff4ea24cc59b96801d64f9b158a4b0f0dbdd59bf84eb29473285faeb1

SHA512
d6bc53acf5831c91d38155d87d03e2813a0db25489562160e8c2ee3d185acd916b3769885cc0897f252576c829109aea9731bcbd2f10c903ee0ef90755b6b8cc

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
5f993bf1bff57061055964a31423292f

SHA1
1f3ff57a745138f0cd4947df95ac88a20e7e3e8c

SHA256
32c698415e3ac33a07df86f258a4e236ad2f86f624c3b837b52acda729f5611c

SHA512
e4da878f9329906d21209f518bf23d577b2164fc0295c04ad186fb37addbcd5da33b9e51a0cf7720e7287684859eead488ae958d79a206936e247905aa9d7fe0

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
f4592d4e6ecf42b9030ac9b6a49f6201

SHA1
f636a05a6ff6a233cdb1edeba617b86eeeb3b30d

SHA256
5300e983cbc5f034dd01e77ca85fcf444636434deaf08bd987c9388b24782980

SHA512
7e2119d7889aeb9c36b9fb720df37d88e0cd2ef6ee15e664e191bf14df97e6b46b75d94ac004ca0207a4813f8d02b11cb6b5b89c2aedb6c4b8ed1d07df417513

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
d0e2525af9579f0ff67ec0b418f92904

SHA1
e10dbd409432a67af4fb9879d33178b81f539271

SHA256
b040c4ef063be9b884ce2e2d73106af50bce3385635581b56528767f47daa18c

SHA512
09188645f8bbe2b6cc71d91241ddebfbc60744f2867609d516cc405a9139b30a28e795b2a31b07db7f5b405c06323a0e157187efaf8336aeabe2dfdc318b6ba0

Download Submit
C:\ProgramData\44\Process.txt

Filesize
622B

MD5
688d32be6057b2b8763ec44e3c0cd144

SHA1
fd72e1de647b7d5ce82cbcd41529b6abba564fff

SHA256
1fc6484195528b8e1377823f7d09aecadba68d88b6ff750424823bc07276c332

SHA512
8e776ad5ac26b5ee9461a827b0dd923492a3d79632df2149c03b5bae8521b21bb4dad4fc2e1038e43a0679cb66e8df891321ee1d15ebb0830c50e426faf81f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\物商物望家她.exe

Filesize
971KB

MD5
df61aa9b6626a6aed2da2edc8a33f0e5

SHA1
1d493fa7505b140d4c13b66486b86c332bd96396

SHA256
fa6eae73527d0fe9a5b011b225d21ea71f7d8363e57de3347ebb817ed3b43443

SHA512
4989dba701959001a0f6e14053ebe9838e0350e7140fd7c96cccefc75f75aa77338bdce80ef1c5b98c8b3bc459a195c889925ae41ffeac9c8cc78050fcb0a30e

Download Submit
memory/3608-158-0x00000000062E0000-0x0000000006346000-memory.dmp

Filesize
408KB

Download
memory/3608-25-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/3608-161-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/3608-57-0x00000000065B0000-0x0000000006B54000-memory.dmp

Filesize
5.6MB

Download
memory/3608-27-0x0000000005E60000-0x0000000005EF2000-memory.dmp

Filesize
584KB

Download
memory/3608-22-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3608-26-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/4468-17-0x0000000002610000-0x0000000002666000-memory.dmp

Filesize
344KB

Download
memory/4468-24-0x00007FFE93A60000-0x00007FFE94521000-memory.dmp

Filesize
10.8MB

Download
memory/4468-21-0x0000000002680000-0x0000000002690000-memory.dmp

Filesize
64KB

Download
memory/4468-20-0x0000000002700000-0x000000000270A000-memory.dmp

Filesize
40KB

Download
memory/4468-19-0x00007FFE93A60000-0x00007FFE94521000-memory.dmp

Filesize
10.8MB

Download
memory/4540-18-0x00007FFE93A60000-0x00007FFE94521000-memory.dmp

Filesize
10.8MB

Download
memory/4540-0-0x0000000000A80000-0x0000000000B78000-memory.dmp

Filesize
992KB

Download
memory/4540-4-0x0000000002C20000-0x0000000002C2A000-memory.dmp

Filesize
40KB

Download
memory/4540-3-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/4540-2-0x00007FFE93A60000-0x00007FFE94521000-memory.dmp

Filesize
10.8MB

Download
memory/4540-1-0x0000000002BD0000-0x0000000002C26000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads