General

  • Target

    CLModdingTool.exe

  • Size

    2.8MB

  • Sample

    240514-mfb3aabg3s

  • MD5

    3e8467e2688b2efa61f59f22f809f1e0

  • SHA1

    a6c5df599e482932d3beda04c8ec6280fe6d68e8

  • SHA256

    eb18e1c355e002f0589621dd7f67605004874c016ac7e3f3ea93ee0092a183ff

  • SHA512

    43c252147ac8e63ad28d672ef866608af523e73991093d650b61a40c55b7415208bc472d29e6e8c650ca580b0b71ff35af0e4945d387e242878a114ea84883d5

  • SSDEEP

    49152:9svNXfFAw+qqIlu3Ab7AUziVj3djevc2FmpLAcyxEDIUqsfix5b4qPcxxKppk:9sdfmZIllvYj3djeUHhaESV5b4qPIKLk

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1239664839861731431/VT6K0qlAVUjcvrSdaA7o80cVaJyetsfS1bh1v1T-yNWgA-Xp45pD3IwxPT8-ZVpBj_mb

Extracted

Family

xworm

Version

5.0

C2

central-feb.gl.at.ply.gg:50764

Mutex

v9noCapeVzXu1P4f

Attributes
  • Install_directory

    %AppData%

  • install_file

    ModsInstaller.exe

aes.plain

Targets

    • Target

      CLModdingTool.exe

    • Size

      2.8MB

    • MD5

      3e8467e2688b2efa61f59f22f809f1e0

    • SHA1

      a6c5df599e482932d3beda04c8ec6280fe6d68e8

    • SHA256

      eb18e1c355e002f0589621dd7f67605004874c016ac7e3f3ea93ee0092a183ff

    • SHA512

      43c252147ac8e63ad28d672ef866608af523e73991093d650b61a40c55b7415208bc472d29e6e8c650ca580b0b71ff35af0e4945d387e242878a114ea84883d5

    • SSDEEP

      49152:9svNXfFAw+qqIlu3Ab7AUziVj3djevc2FmpLAcyxEDIUqsfix5b4qPcxxKppk:9sdfmZIllvYj3djeUHhaESV5b4qPIKLk

    • 44Caliber

      An open source infostealer written in C#.

    • Detect Xworm Payload

    • Modifies security service

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Creates new service(s)

    • Sets service image path in registry

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks