44caliber | a3b4fb3bff6fa8148bc992fb0001754073de7f13f91d9e72d2ba1f4f025b4f1a

General

Target

308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
Size

2.7MB
MD5

308ce465211f1556a686990b6ffbeec0
SHA1

bffe19ca967c9cf6c9637f74d35c9d2a7ab103fc
SHA256

a3b4fb3bff6fa8148bc992fb0001754073de7f13f91d9e72d2ba1f4f025b4f1a
SHA512

a85b1a939b65776d26bdf5ef0efca15ef9e37c3353dd4383ed24e8f189cbcbfd33747e93f3f758710e20a411cbdf4fb33e43c519b255094e81b7c4b06c043efd
SSDEEP

49152:3iL9aT3HOoHrXBUugXr8R/8XXiYxPiTDIv5i:30wHPLBUuJ

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1247395609405558835/sQcLThBLDYbTadfEd-ByBW9kmP5p8xXRMOQAbUJKzWBnNj8pr7Kt8nm1B3tE8UBUkbXd

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 freegeoip.app
9 freegeoip.app
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

pid process

2332 308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
2332 308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

flow	ioc
8	freegeoip.app
9	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

pid	process
2332	308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
2332	308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
2332	308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
2332	308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

description pid process

Token: SeDebugPrivilege 2332 308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

pid process

2332 308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	2332	308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
1KB

MD5
bc888b3392648f513c1477b0aef8e566

SHA1
a8f94fd7d173f1d4b4eef79957b624a9f0495910

SHA256
8178f49595bca83c552d59f4c4cda5d4485459f25c9fa0752eec3b28bd459828

SHA512
acfadac26d1e1962ef6ead33bb53f0088a17b969fe9ecc34690b8b42aa76e41e246a3b9c4cfba0528a11d719f6dedc8e7838d3778d76847506e98e351d99e99d

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
911B

MD5
10ec3c20e5ca00314c6a52b558acb25e

SHA1
97a107d61d3b8e402a8d11108097379009ae840b

SHA256
502a54246484a0b47f403d52b6e7c93e64be0ca6ac14eeb3c1a173bc0b4c4990

SHA512
9c4abcc584228adcb170f8a1559b4ecfd93d7b175b2c0fc4ed4452344022a1f25c090f21ac43e584cbcebca80f9cd8afa307243496952938e83093c9eef433c0

Download Submit
memory/2332-0-0x0000000000110000-0x00000000004BA000-memory.dmp

Filesize
3.7MB

Download
memory/2332-1-0x000000007457E000-0x000000007457F000-memory.dmp

Filesize
4KB

Download
memory/2332-2-0x0000000000110000-0x00000000004BA000-memory.dmp

Filesize
3.7MB

Download
memory/2332-3-0x0000000074570000-0x0000000074D20000-memory.dmp

Filesize
7.7MB

Download
memory/2332-8-0x0000000005E80000-0x0000000005F12000-memory.dmp

Filesize
584KB

Download
memory/2332-36-0x00000000069D0000-0x0000000006F74000-memory.dmp

Filesize
5.6MB

Download
memory/2332-127-0x0000000006900000-0x0000000006966000-memory.dmp

Filesize
408KB

Download
memory/2332-132-0x0000000000110000-0x00000000004BA000-memory.dmp

Filesize
3.7MB

Download
memory/2332-133-0x0000000074570000-0x0000000074D20000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing