44caliber | d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae

General

Target

d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe
Size

303KB
MD5

c763e936df8e54ad67dbfa4b3bd3c0bc
SHA1

beaaa7a141823c64fb245f19ac3c2251fef900d1
SHA256

d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae
SHA512

4eafdd8a3f3f8041d51ea1019a1695f46781c5d47be7d1142a043c4cf9531a07343583f1c148db9277341a82aa1380bf2df2c866382ee8b9bfef611f0c78c5c1
SSDEEP

6144:iBcT6MDdbICydeBP0+KUmylpnY6rmA1D0RWE:iBKM+KUmapY41DbE

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1226160357496721500/M8J7D5k1hO1RyahDiTtwdkk4Fvbpx4urcIZZllG8IAXSc4eGIg2m6G4UbF_cjPMvvv0D

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs

resource	yara_rule
behavioral1/memory/1800-0-0x00000000002A0000-0x00000000002F2000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1800-2-0x0000000000600000-0x0000000000680000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 2 IoCs

resource	yara_rule
behavioral1/memory/1800-0-0x00000000002A0000-0x00000000002F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral1/memory/1800-2-0x0000000000600000-0x0000000000680000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables referencing Discord tokens regular expressions 2 IoCs

resource	yara_rule
behavioral1/memory/1800-0-0x00000000002A0000-0x00000000002F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex
behavioral1/memory/1800-2-0x0000000000600000-0x0000000000680000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex

Detects executables referencing credit card regular expressions 2 IoCs

resource	yara_rule
behavioral1/memory/1800-0-0x00000000002A0000-0x00000000002F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral1/memory/1800-2-0x0000000000600000-0x0000000000680000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Detects executables referencing many VPN software clients. Observed in infosteslers 2 IoCs

resource	yara_rule
behavioral1/memory/1800-0-0x00000000002A0000-0x00000000002F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_VPN
behavioral1/memory/1800-2-0x0000000000600000-0x0000000000680000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_VPN

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/memory/1800-0-0x00000000002A0000-0x00000000002F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/1800-2-0x0000000000600000-0x0000000000680000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1800	d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe
1800	d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe
1800	d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2692	1800	d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe	28
PID 1800 wrote to memory of 2692	1800	d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe	28
PID 1800 wrote to memory of 2692	1800	d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe	28

C:\Users\Admin\AppData\Local\Temp\d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe
"C:\Users\Admin\AppData\Local\Temp\d006975785908bd891378c66553267cb89746e95a6728d877941e6f25c94f3ae.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1800 -s 1180
  2⤵
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-0-0x00000000002A0000-0x00000000002F2000-memory.dmp

Filesize
328KB

Download
memory/1800-1-0x000007FEF50D0000-0x000007FEF5ABC000-memory.dmp

Filesize
9.9MB

Download
memory/1800-2-0x0000000000600000-0x0000000000680000-memory.dmp

Filesize
512KB

Download
memory/1800-21-0x000007FEF50D0000-0x000007FEF5ABC000-memory.dmp

Filesize
9.9MB

Download
memory/1800-22-0x0000000000600000-0x0000000000680000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing