44caliber | ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04

General

Target

ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe
Size

281KB
MD5

c2a957c32ba544e18bdce5c89b31e4ec
SHA1

4ffea92024bfa254b6cde85f9b3bc203d1c268fb
SHA256

ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04
SHA512

97b080498fca48a287f15cbae0a12042f865f839af67d29c51459ef685eb25f49ce089424be1886ab7c7e5f5cf922770e80f2874f12c9aaeff63b749ec612827
SSDEEP

3072:idHdrST3duBTeYNq83VpxQinpsXfuAfAQcUC+bqAHd84sHjhIrdlfGm23hI/KQ7L:cs3duBaYNqhWQGWqAHS4sHjKZxE

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1227237091100856442/BrQxsxv7iOW1INure2NRj8h9j_kNz4zTZWTlu2pl8X31A4tO36IWEoyPoqQ6KOZ7S1qy

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000900000-0x000000000094C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1936-2-0x000000001B430000-0x000000001B4B0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000900000-0x000000000094C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral1/memory/1936-2-0x000000001B430000-0x000000001B4B0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables referencing Discord tokens regular expressions 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000900000-0x000000000094C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex
behavioral1/memory/1936-2-0x000000001B430000-0x000000001B4B0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex

Detects executables referencing credit card regular expressions 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000900000-0x000000000094C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral1/memory/1936-2-0x000000001B430000-0x000000001B4B0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Detects executables referencing many VPN software clients. Observed in infosteslers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000900000-0x000000000094C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_VPN
behavioral1/memory/1936-2-0x000000001B430000-0x000000001B4B0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_VPN

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000900000-0x000000000094C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/1936-2-0x000000001B430000-0x000000001B4B0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe

pid	Process
1936	ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe
1936	ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe
1936	ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe

description	pid	Process
Token: SeDebugPrivilege	1936	ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe

description	pid	Process	procid_target
PID 1936 wrote to memory of 2628	1936	ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe	28
PID 1936 wrote to memory of 2628	1936	ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe	28
PID 1936 wrote to memory of 2628	1936	ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe	28

C:\Users\Admin\AppData\Local\Temp\ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe
"C:\Users\Admin\AppData\Local\Temp\ad163810f30beced498a9a1a318feace07c079aba853f34684d2e1c9a796ab04.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1936 -s 1072
  2⤵
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000900000-0x000000000094C000-memory.dmp

Filesize
304KB

Download
memory/1936-1-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/1936-2-0x000000001B430000-0x000000001B4B0000-memory.dmp

Filesize
512KB

Download
memory/1936-22-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/1936-23-0x000000001B430000-0x000000001B4B0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads