Overview

overview

10

Static

static

3

308ce46521...cs.exe

windows7-x64

10

308ce46521...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 09:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    308ce465211f1556a686990b6ffbeec0

  • SHA1

    bffe19ca967c9cf6c9637f74d35c9d2a7ab103fc

  • SHA256

    a3b4fb3bff6fa8148bc992fb0001754073de7f13f91d9e72d2ba1f4f025b4f1a

  • SHA512

    a85b1a939b65776d26bdf5ef0efca15ef9e37c3353dd4383ed24e8f189cbcbfd33747e93f3f758710e20a411cbdf4fb33e43c519b255094e81b7c4b06c043efd

  • SSDEEP

    49152:3iL9aT3HOoHrXBUugXr8R/8XXiYxPiTDIv5i:30wHPLBUuJ

Score
10/10
44caliberspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1247395609405558835/sQcLThBLDYbTadfEd-ByBW9kmP5p8xXRMOQAbUJKzWBnNj8pr7Kt8nm1B3tE8UBUkbXd

Signatures

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\308ce465211f1556a686990b6ffbeec0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2332
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1008

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Unsecured Credentials

    2
    T1552

    Credentials In Files

    2
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt
      Filesize

      105B

      MD5

      2e9d094dda5cdc3ce6519f75943a4ff4

      SHA1

      5d989b4ac8b699781681fe75ed9ef98191a5096c

      SHA256

      c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

      SHA512

      d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

      Download Submit
    • C:\Users\Admin\AppData\Local\44\Process.txt
      Filesize

      1KB

      MD5

      bc888b3392648f513c1477b0aef8e566

      SHA1

      a8f94fd7d173f1d4b4eef79957b624a9f0495910

      SHA256

      8178f49595bca83c552d59f4c4cda5d4485459f25c9fa0752eec3b28bd459828

      SHA512

      acfadac26d1e1962ef6ead33bb53f0088a17b969fe9ecc34690b8b42aa76e41e246a3b9c4cfba0528a11d719f6dedc8e7838d3778d76847506e98e351d99e99d

      Download Submit
    • C:\Users\Admin\AppData\Local\44\Process.txt
      Filesize

      911B

      MD5

      10ec3c20e5ca00314c6a52b558acb25e

      SHA1

      97a107d61d3b8e402a8d11108097379009ae840b

      SHA256

      502a54246484a0b47f403d52b6e7c93e64be0ca6ac14eeb3c1a173bc0b4c4990

      SHA512

      9c4abcc584228adcb170f8a1559b4ecfd93d7b175b2c0fc4ed4452344022a1f25c090f21ac43e584cbcebca80f9cd8afa307243496952938e83093c9eef433c0

      Download Submit
    • memory/2332-0-0x0000000000110000-0x00000000004BA000-memory.dmp
      Filesize

      3.7MB

      Download
    • memory/2332-1-0x000000007457E000-0x000000007457F000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2332-2-0x0000000000110000-0x00000000004BA000-memory.dmp
      Filesize

      3.7MB

      Download
    • memory/2332-3-0x0000000074570000-0x0000000074D20000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/2332-8-0x0000000005E80000-0x0000000005F12000-memory.dmp
      Filesize

      584KB

      Download
    • memory/2332-36-0x00000000069D0000-0x0000000006F74000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/2332-127-0x0000000006900000-0x0000000006966000-memory.dmp
      Filesize

      408KB

      Download
    • memory/2332-132-0x0000000000110000-0x00000000004BA000-memory.dmp
      Filesize

      3.7MB

      Download
    • memory/2332-133-0x0000000074570000-0x0000000074D20000-memory.dmp
      Filesize

      7.7MB

      Download