Overview

overview

10

Static

static

3

ovisetup.exe

windows7-x64

10

ovisetup.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 18:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ovisetup.exe
  • Size 3.7MB
  • Sample240608-xe7snsef3s
  • SHA256 bb5c467c398cbbb648668f5aaec8da190eab2de1fb2ee47d0e03b01483b4f53e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
44caliberevasionspywarestealertrojan

Malware Config

Extracted

Family

  • 44caliber

C2

  • https://discord.com/api/webhooks/1140967450750484572/9nxWu2w_HfkHC1lMMNnzNPxLArNJ-MGc7djzUyKDcKdtmuzCF7HY_Gilg6rdXdzPw-v4

Signatures

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ovisetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ovisetup.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\cheats.exe
      "C:\Users\Admin\AppData\Local\Temp\cheats.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3852
    • C:\Users\Admin\AppData\Local\Temp\vanishvpn.exe
      "C:\Users\Admin\AppData\Local\Temp\vanishvpn.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4836
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2372
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4068
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4508

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            cheats.exe
            • Path C:\Users\Admin\AppData\Local\Temp\cheats.exe
            • Size 274KB
            • SHA256 d1db9e33522f50a835616658c4fd2831d87fa9db303bdf9e4571d45f94977a42
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vanishvpn.exe
            • Path C:\Users\Admin\AppData\Local\Temp\vanishvpn.exe
            • Size 4.3MB
            • SHA256 4a3ea8123316dd531d080ebd15f50dd1448e7d443c45c81d59556efb7265900f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Process.txt
            • Path C:\Users\Admin\AppData\Roaming\44\Process.txt
            • Size 1KB
            • SHA256 f72c7ffe945a7a5e8e39d73be15aa459d5c12735a8972dad57dc5e151894db5a
            • MD5 SHA1 SHA512
            Submit Download

            memory/2372-60-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-58-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-50-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-49-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-61-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-55-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-59-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-51-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-57-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/2372-56-0x0000013901FE0000-0x0000013901FE1000-memory.dmp
            Download

            memory/3852-18-0x0000024C76620000-0x0000024C7666A000-memory.dmp
            Download

            memory/4836-46-0x00007FF75A8E0000-0x00007FF75B181000-memory.dmp
            Download

            memory/4836-160-0x00007FF75A8E0000-0x00007FF75B181000-memory.dmp
            Download

            memory/4836-162-0x00007FF75A8E0000-0x00007FF75B181000-memory.dmp
            Download