Overview

overview

10

Static

static

3

New Project 1.exe

windows7-x64

10

New Project 1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 13:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Project 1.exe

  • Size

    4.9MB

  • MD5

    eace0ed3521967a36f02f3408a76689d

  • SHA1

    54210340f93b45b7bd0eff93da29151a5e846174

  • SHA256

    a2d773d335de672b8b525f26483081ef86bdfbb524afdf3dab5922e66d864e96

  • SHA512

    9646a69340e263150fc05519576fdc4d07ef51cf05f974dfd4f94b866e896255ee469207b6181b976d253a2497a753439c1ec639897dbe7c0fb89674eaba6448

  • SSDEEP

    98304:w409oEFvy98NF/4uhbfc7DdGnTYrhMiAV4i2BWWH:i/FayNFQKU7qstyKnJ

Score
10/10
44caliberspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1237112288494747648/RwLhzmD0ehxDiBdZsbgoSXVKoOkldpfaRP7ikjkQV9Ya8EVVXay-1UF3yarrrtlSnrpv

Signatures

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Project 1.exe
    "C:\Users\Admin\AppData\Local\Temp\New Project 1.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\AppData\Local\Temp\extreme injector.exe
      "C:\Users\Admin\AppData\Local\Temp\extreme injector.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
        "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2116
      • C:\Users\Admin\AppData\Local\Temp\Insidious.exe
        "C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2304
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2304 -s 1188
          4⤵
            PID:484

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar107C.tmp
      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

      Download Submit

    • \Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
      Filesize

      1.9MB

      MD5

      ec801a7d4b72a288ec6c207bb9ff0131

      SHA1

      32eec2ae1f9e201516fa7fcdc16c4928f7997561

      SHA256

      b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

      SHA512

      a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

      Download Submit

    • \Users\Admin\AppData\Local\Temp\Insidious.exe
      Filesize

      281KB

      MD5

      b3cc053a740c79d2844a542e951b3335

      SHA1

      44fa83e0bfd8c7761ba8fbe0f687a53a062d89a0

      SHA256

      278704c25e1f4fb26e09a663ea2e0762510d02837ced1771d72c0240e3f9b993

      SHA512

      b7ffb66a9b7fa366dfc4b12978ad8d3555859ff526d8d1f8f9557ff22cf0cdf44369796722b22f0da28c79850f3cb16b3e9c49c8db2f8ab64e66661322f46cbe

      Download Submit

    • \Users\Admin\AppData\Local\Temp\extreme injector.exe
      Filesize

      3.3MB

      MD5

      2ffea9e69ec40e9f4337787a953e02f1

      SHA1

      5d2df0bec27c916a95b39d90f2c4cbfe485a4e29

      SHA256

      a0c52d8be54a2437a28412f63fd7bb700b15b10a6cf8640630fd35ed6bf68204

      SHA512

      6ecd979f26ef0095825dfe40123129a973dd2daccfa2e04eb0b71e8615d2abf439b134200abdec4794216d237b12c961520eb11f76277660807a859a919e1698

      Download Submit

    • memory/1496-125-0x0000000000400000-0x0000000000743000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/2116-140-0x0000000000940000-0x0000000000B26000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2272-0-0x0000000000400000-0x00000000008E6000-memory.dmp

      Filesize

      4.9MB

      Download

    • memory/2304-139-0x0000000000EF0000-0x0000000000F3C000-memory.dmp

      Filesize

      304KB

      Download