44caliber | 60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf

General

Target

60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
Size

1.9MB
MD5

efeb40096e1a60f97a1258b070d49355
SHA1

133f1910684c0fe0f011c65b7e34b9c1c96ad547
SHA256

60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf
SHA512

ff8728e5c1950b1f0111e738446efcb4462a7472d1bfc2466b25ccee26113e4ea4117eb8176b4e738f0b270ae678995f65785c618524fba1dab465985feac901
SSDEEP

24576:4VjAexEhMSmTVjAexEhdd74MROxnF/grrcI0AilFEvxHPE4QooFI:pGUDaMi6rrcI0AilFEvxHPEy

Score

10^/10

44caliber orcus dup rat spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1230453187920658442/0DLiOzNARmlV9YkQawqhFddTXmXbAH-u7b6bGKX5-MD8hY4I0upEZ9kZsB7sI4nBhjEX

Extracted

Family

orcus

Botnet

Dup

C2

127.0.0.1:1268

Mutex

8986e5e934d6456b941d30af15cc57c7

Attributes

autostart_method
Disable
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000002326e-16.dat	family_orcus
behavioral2/files/0x0008000000023287-55.dat	family_orcus

Orcurs Rat Executable 5 IoCs

resource	yara_rule
behavioral2/files/0x000800000002326e-16.dat	orcus
behavioral2/memory/372-20-0x0000000000400000-0x00000000005E9000-memory.dmp	orcus
behavioral2/files/0x0008000000023287-55.dat	orcus
behavioral2/memory/2776-61-0x0000000000400000-0x0000000000548000-memory.dmp	orcus
behavioral2/memory/516-64-0x0000000000FB0000-0x000000000109A000-memory.dmp	orcus

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Cortex Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Cortex.exe

Executes dropped EXE 4 IoCs

pid	Process
2756	Cartex.exe
2776	Cortex Launcher.exe
516	Cortex.exe
2992	Orcus.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	freegeoip.app
6	freegeoip.app

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Orcus\Orcus.exe	Cortex.exe
File opened for modification	C:\Program Files (x86)\Orcus\Orcus.exe	Cortex.exe
File created	C:\Program Files (x86)\Orcus\Orcus.exe.config	Cortex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Cartex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Cartex.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2756	Cartex.exe
2756	Cartex.exe
2756	Cartex.exe
2756	Cartex.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	Cartex.exe
Token: SeDebugPrivilege	2992	Orcus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	Orcus.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2992	Orcus.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	Orcus.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 2756	372	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	91
PID 372 wrote to memory of 2756	372	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	91
PID 372 wrote to memory of 2776	372	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	92
PID 372 wrote to memory of 2776	372	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	92
PID 372 wrote to memory of 2776	372	60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe	92
PID 2776 wrote to memory of 516	2776	Cortex Launcher.exe	93
PID 2776 wrote to memory of 516	2776	Cortex Launcher.exe	93
PID 2776 wrote to memory of 516	2776	Cortex Launcher.exe	93
PID 516 wrote to memory of 2992	516	Cortex.exe	95
PID 516 wrote to memory of 2992	516	Cortex.exe	95
PID 516 wrote to memory of 2992	516	Cortex.exe	95

C:\Users\Admin\AppData\Local\Temp\60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe
"C:\Users\Admin\AppData\Local\Temp\60b31c2e2e564debf4560d50673a23034b4267dba853230a67550540749102bf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:372
- C:\Users\Admin\AppData\Local\Temp\Cartex.exe
  "C:\Users\Admin\AppData\Local\Temp\Cartex.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Cortex.exe
    "C:\Users\Admin\AppData\Local\Temp\Cortex.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\Program Files (x86)\Orcus\Orcus.exe
      "C:\Program Files (x86)\Orcus\Orcus.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Orcus\Orcus.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
202B

MD5
47b987190509b43f0e127d56e0282882

SHA1
2da21dc740f3a6046a25ea800f5d10f3bb1bc85e

SHA256
4b863a89df8d8ba2b3b8ce0e5fc4cc13c3a8e78923ba2daa6bbaa033f93a12f3

SHA512
1592872d2beb8eaa8042dc1d4add846c2bc9d2e73cf86d8c684dc9f060f3aad83f3513adaebf43d72de28e8b4d6cf2ceda4a2a6e30e576d25100929378bc0862

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
1KB

MD5
976d933620f753b308332f720ca01f52

SHA1
7efb05f1c61c57c849395b6679e888d4af77296a

SHA256
6c97004cd90647ef7816bd000ddecd6e08727a630f6680fbb131de07664736ab

SHA512
6c4d24e53a740b2bb9a051f41a912d320204cf1c74fc2173ae193c45a130cb38fdfbe4f8d1e485589399765ce84b8a1e6c519885feea05ee29911553ba4b5420

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cartex.exe

Filesize
274KB

MD5
b0e26ccf1d3180fecd30a685d22390ad

SHA1
d20b553dea1425f5d85b6e1af23ea32c063ed3fb

SHA256
71756da4e3e8d02d44656518e3863a5477c197e991e62c785f1e0e8e739f0fe7

SHA512
4d2ba5292642e88fd0d52ae386ddcb06bdcd9478d4a594def61e84b57fb5637b97254b81ca7c457a0de43b9c32b62a25e3e2f94fe8061b30126fd966ac9b37e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cortex Launcher.exe

Filesize
1.3MB

MD5
44566fbbb0f447a1560a614fec6a6988

SHA1
3a76bf992012c775e8cc5a6b54f6417b2cdc8552

SHA256
daa00b164ed37d0f65c9d54095d67405e588163ddcac190240fd9316b411231c

SHA512
8ba77aba1c1b17d357854d7531ea3786786c9495959a2ca033abcce6187cc6117c45765f246918cf34408e221a871e4c56359f38d8da5871e327543fe148d6b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cortex.exe

Filesize
910KB

MD5
9fc39d72aad030cc4734b024dea538f1

SHA1
bc5ce1c73b404ca308c327b49696a6eb3da8089f

SHA256
8d55cd0abe78a6d6bb808debcae912757451129b8a99eacca0a625fe4cff4b76

SHA512
68ff6779be0290d774fe28c0b760f815934576893eff59af135dad006578dc294fd79e2d300ac812be5b4509cd4f84581bf0bbbd400ffdb8f303b2e653523277

Download Submit
memory/372-20-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/516-160-0x0000000006140000-0x00000000066E4000-memory.dmp

Filesize
5.6MB

Download
memory/516-159-0x0000000005A70000-0x0000000005ACC000-memory.dmp

Filesize
368KB

Download
memory/516-64-0x0000000000FB0000-0x000000000109A000-memory.dmp

Filesize
936KB

Download
memory/516-162-0x0000000005C20000-0x0000000005C32000-memory.dmp

Filesize
72KB

Download
memory/516-134-0x00000000034F0000-0x0000000003500000-memory.dmp

Filesize
64KB

Download
memory/516-163-0x00000000060D0000-0x00000000060D8000-memory.dmp

Filesize
32KB

Download
memory/516-158-0x00000000034B0000-0x00000000034BE000-memory.dmp

Filesize
56KB

Download
memory/516-63-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/516-178-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/516-161-0x0000000005C30000-0x0000000005CC2000-memory.dmp

Filesize
584KB

Download
memory/2756-26-0x000001F06EF30000-0x000001F06EF40000-memory.dmp

Filesize
64KB

Download
memory/2756-25-0x00007FFAE92C0000-0x00007FFAE9D81000-memory.dmp

Filesize
10.8MB

Download
memory/2756-14-0x000001F06C990000-0x000001F06C9DA000-memory.dmp

Filesize
296KB

Download
memory/2756-186-0x00007FFAE92C0000-0x00007FFAE9D81000-memory.dmp

Filesize
10.8MB

Download
memory/2776-61-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/2992-180-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/2992-182-0x0000000005370000-0x0000000005388000-memory.dmp

Filesize
96KB

Download
memory/2992-181-0x0000000005340000-0x0000000005352000-memory.dmp

Filesize
72KB

Download
memory/2992-179-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/2992-187-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/2992-185-0x0000000005CD0000-0x0000000005E92000-memory.dmp

Filesize
1.8MB

Download
memory/2992-188-0x0000000005C50000-0x0000000005C5A000-memory.dmp

Filesize
40KB

Download
memory/2992-189-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/2992-190-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads