44caliber | 32f70eace4fb8d3d0711c104f7d9ed18a3e7b62c4eb44e6ee8fa2fef9101fb40

General

Target

XClient.exe
Size

78KB
MD5

08a0de0b53d4a1f754e89317e97cc876
SHA1

79aa570739ea7ce828df347852fe7cd7947eab73
SHA256

32f70eace4fb8d3d0711c104f7d9ed18a3e7b62c4eb44e6ee8fa2fef9101fb40
SHA512

b7d828778f4def78b0f6b8ec7112c1e002656aafae3e355cb5498155a898a5361dcd75fc2673111ace6aae7edd309b6aa2daa1eb9d9503ddc693de4a21a22423
SSDEEP

1536:EruZeKyBO87fRW6IxjbXtL6Kvvqsu6wGistrOO7XTZqAATQ:CuYHB5Wdhb9Lz3wOpqRQ

Score

10^/10

44caliber xworm evasion persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

C2

daily-lawn.gl.at.ply.gg:28256

Attributes

Install_directory
%Public%
install_file
XClient.exe

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1229291998217900033/GZFkLc0s0Q0ECz4_Tuxz0BFCTwRpQTyBwxULLeHGGvrfOVLwLMhvhN6RoOgaFkDcUzK5

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/1180-122-0x000000001DDF0000-0x000000001DDFE000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1180-0-0x00000000009C0000-0x00000000009DA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4820 netsh.exe

pid	process
4820	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

XClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 1 IoCs

Processes:

vfyxug.exe

pid process

1544 vfyxug.exe
Loads dropped DLL 1 IoCs

Processes:

XClient.exe

pid process

1180 XClient.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1544	vfyxug.exe

pid	process
1180	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Public\\XClient.exe"	XClient.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

58 freegeoip.app
59 freegeoip.app
37 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
58	freegeoip.app
59	freegeoip.app
37	ip-api.com

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exevfyxug.exe

pid	process
4252	powershell.exe
4252	powershell.exe
1316	powershell.exe
1316	powershell.exe
3180	powershell.exe
3180	powershell.exe
3412	powershell.exe
3412	powershell.exe
1180	XClient.exe
1544	vfyxug.exe
1544	vfyxug.exe
1544	vfyxug.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exevfyxug.exe

description	pid	process
Token: SeDebugPrivilege	1180	XClient.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	1180	XClient.exe
Token: SeDebugPrivilege	1544	vfyxug.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid process

1180 XClient.exe

pid	process
1180	XClient.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

XClient.exe

description	pid	process	target process
PID 1180 wrote to memory of 4252	1180	XClient.exe	powershell.exe
PID 1180 wrote to memory of 4252	1180	XClient.exe	powershell.exe
PID 1180 wrote to memory of 1316	1180	XClient.exe	powershell.exe
PID 1180 wrote to memory of 1316	1180	XClient.exe	powershell.exe
PID 1180 wrote to memory of 3180	1180	XClient.exe	powershell.exe
PID 1180 wrote to memory of 3180	1180	XClient.exe	powershell.exe
PID 1180 wrote to memory of 3412	1180	XClient.exe	powershell.exe
PID 1180 wrote to memory of 3412	1180	XClient.exe	powershell.exe
PID 1180 wrote to memory of 1544	1180	XClient.exe	vfyxug.exe
PID 1180 wrote to memory of 1544	1180	XClient.exe	vfyxug.exe
PID 1180 wrote to memory of 4820	1180	XClient.exe	netsh.exe
PID 1180 wrote to memory of 4820	1180	XClient.exe	netsh.exe
PID 1180 wrote to memory of 540	1180	XClient.exe	CMD.EXE
PID 1180 wrote to memory of 540	1180	XClient.exe	CMD.EXE

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\XClient.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Users\Admin\AppData\Local\Temp\vfyxug.exe
"C:\Users\Admin\AppData\Local\Temp\vfyxug.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
2⤵
- Modifies Windows Firewall
PID:4820

C:\Windows\SYSTEM32\CMD.EXE
"CMD.EXE"
2⤵
PID:540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
8f659389c6e21eb0c627fbae833500c7

SHA1
ae632f1e4af08587934ff168155b30e2b28d7475

SHA256
a12763453f79453dd8f25f0c90d001ffb5d409ec698491666c9f076c6bc60d8c

SHA512
f4849e0b1d6ab3d4dd054f590a359af8dd1b9d3df2ad78033ad1a59ebafb1ca96aa76fa9061a466d74e8e3266dc882818d79db47908b21ca3ef8be20e427d327

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m205qm2x.ib1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAD52.tmp
Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
C:\Users\Admin\AppData\Local\Temp\vfyxug.exe
Filesize
303KB

MD5
c31f98a5173943dffbd5faa26cade8ec

SHA1
948b5d6962ffdec957ada3c46d8e70a78e33a9b6

SHA256
f3af5526d5b5ecc94c791b813953ab24057cdbbe447d1da37e0b0cf9816fa92e

SHA512
792dd43abf9e50b5f5611bb8aae101032e6073c45d90890c5a2f23f9f0d70510a281adbe3678095265b437a2db8fd22edcdb77e51f0fb561614452a5230b7418

Download Submit
memory/1180-2-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/1180-117-0x0000000001120000-0x000000000115A000-memory.dmp

Filesize
232KB

Download
memory/1180-122-0x000000001DDF0000-0x000000001DDFE000-memory.dmp

Filesize
56KB

Download
memory/1180-0-0x00000000009C0000-0x00000000009DA000-memory.dmp

Filesize
104KB

Download
memory/1180-71-0x000000001DEF0000-0x000000001DEFC000-memory.dmp

Filesize
48KB

Download
memory/1180-70-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/1180-1-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/1180-69-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/1180-123-0x000000001DE30000-0x000000001DE3A000-memory.dmp

Filesize
40KB

Download
memory/1316-26-0x000001CE20050000-0x000001CE20060000-memory.dmp

Filesize
64KB

Download
memory/1316-35-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/1316-20-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/1316-31-0x000001CE20050000-0x000001CE20060000-memory.dmp

Filesize
64KB

Download
memory/1316-33-0x000001CE20050000-0x000001CE20060000-memory.dmp

Filesize
64KB

Download
memory/1544-115-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/1544-83-0x000001FD5C4D0000-0x000001FD5C522000-memory.dmp

Filesize
328KB

Download
memory/1544-85-0x000001FD76AF0000-0x000001FD76B00000-memory.dmp

Filesize
64KB

Download
memory/1544-84-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/3180-38-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/3180-46-0x00000208D5A10000-0x00000208D5A20000-memory.dmp

Filesize
64KB

Download
memory/3180-50-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/3180-47-0x00000208D5A10000-0x00000208D5A20000-memory.dmp

Filesize
64KB

Download
memory/3412-60-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/3412-64-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/3412-62-0x0000023F69540000-0x0000023F69550000-memory.dmp

Filesize
64KB

Download
memory/4252-9-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/4252-8-0x000001DE37540000-0x000001DE37562000-memory.dmp

Filesize
136KB

Download
memory/4252-15-0x000001DE372C0000-0x000001DE372D0000-memory.dmp

Filesize
64KB

Download
memory/4252-18-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/4252-14-0x000001DE372C0000-0x000001DE372D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads