44caliber | 65b6f1f4ac0fbc8a7a113548630b284a731e0b219bee029745f2710b6e02c51c

General

Target

Downloads.exe
Size

411KB
MD5

87ac4c646fd5b62dbabf59fb6ef34fd7
SHA1

45832029b6cfa6c4020ee0e1f965bd5898d5f137
SHA256

65b6f1f4ac0fbc8a7a113548630b284a731e0b219bee029745f2710b6e02c51c
SHA512

b647910eaeaee60b8d2378986bf824dfddfd9b3a4e0f2a8a723406da1a6072bf9171ee12fd0178e027ddfdc4be8fbb4d74f9e94dd470d4342c6711dbe9ea02b7
SSDEEP

12288:Kat0EAH49n8BLaWNO8DlIlaRJ3wWxJS7Xy4WtZ:Ft24saW02pbWO4g

Score

10^/10

44caliber xworm execution rat spyware stealer trojan

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1253302699978526772/b5mqXVOEs47XQy9dHee2Po12VotJwgdPtLauhKlKoyBH-xF42vUZ2Glc0N58n1pvAEdH

Extracted

Family

xworm

C2

127.0.0.1:32901

engineering-thoroughly.gl.at.ply.gg:32901

Attributes

Install_directory
%AppData%
install_file
OxyInstaller.exe

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\sigma\oxyinstaller.exe	family_xworm
behavioral1/memory/4076-26-0x0000000000BD0000-0x0000000000C28000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1664 powershell.exe
1020 powershell.exe
3688 powershell.exe
916 powershell.exe

pid	process
1664	powershell.exe
1020	powershell.exe
3688	powershell.exe
916	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Downloads.exeoxyinstaller.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	Downloads.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	oxyinstaller.exe

Drops startup file 2 IoCs

Processes:

oxyinstaller.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxyInstaller.lnk	oxyinstaller.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxyInstaller.lnk	oxyinstaller.exe

Executes dropped EXE 2 IoCs

Processes:

Insidious.exeoxyinstaller.exe

pid process

1268 Insidious.exe
4076 oxyinstaller.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 freegeoip.app
4 freegeoip.app
24 ip-api.com

flow	ioc
3	freegeoip.app
4	freegeoip.app
24	ip-api.com

Drops file in Program Files directory 6 IoCs

Processes:

Downloads.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\sigma	Downloads.exe
File created	C:\Program Files (x86)\sigma\__tmp_rar_sfx_access_check_240597156	Downloads.exe
File created	C:\Program Files (x86)\sigma\Insidious.exe	Downloads.exe
File opened for modification	C:\Program Files (x86)\sigma\Insidious.exe	Downloads.exe
File created	C:\Program Files (x86)\sigma\oxyinstaller.exe	Downloads.exe
File opened for modification	C:\Program Files (x86)\sigma\oxyinstaller.exe	Downloads.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

Insidious.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1268	Insidious.exe
1268	Insidious.exe
1268	Insidious.exe
916	powershell.exe
916	powershell.exe
1664	powershell.exe
1664	powershell.exe
1020	powershell.exe
1020	powershell.exe
3688	powershell.exe
3688	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

Insidious.exeoxyinstaller.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1268	Insidious.exe
Token: SeDebugPrivilege	4076	oxyinstaller.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeDebugPrivilege	4076	oxyinstaller.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Downloads.exeoxyinstaller.exe

description	pid	process	target process
PID 2140 wrote to memory of 1268	2140	Downloads.exe	Insidious.exe
PID 2140 wrote to memory of 1268	2140	Downloads.exe	Insidious.exe
PID 2140 wrote to memory of 4076	2140	Downloads.exe	oxyinstaller.exe
PID 2140 wrote to memory of 4076	2140	Downloads.exe	oxyinstaller.exe
PID 4076 wrote to memory of 916	4076	oxyinstaller.exe	powershell.exe
PID 4076 wrote to memory of 916	4076	oxyinstaller.exe	powershell.exe
PID 4076 wrote to memory of 1664	4076	oxyinstaller.exe	powershell.exe
PID 4076 wrote to memory of 1664	4076	oxyinstaller.exe	powershell.exe
PID 4076 wrote to memory of 1020	4076	oxyinstaller.exe	powershell.exe
PID 4076 wrote to memory of 1020	4076	oxyinstaller.exe	powershell.exe
PID 4076 wrote to memory of 3688	4076	oxyinstaller.exe	powershell.exe
PID 4076 wrote to memory of 3688	4076	oxyinstaller.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Downloads.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\sigma\Insidious.exe
  "C:\Program Files (x86)\sigma\Insidious.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Program Files (x86)\sigma\oxyinstaller.exe
  "C:\Program Files (x86)\sigma\oxyinstaller.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\sigma\oxyinstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'oxyinstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OxyInstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OxyInstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\sigma\Insidious.exe

Filesize
303KB

MD5
eefb066dcbb1ae4273c3834f74881a25

SHA1
013657673cb6fbdc4a04db2a4d01332d9ec37363

SHA256
9a23c010ab4bdd266a109740796baecc5b4eb583c1fe8d94b53961a029ca7cc2

SHA512
8d5eab85b0a56351bfc56a4940c1097bc3abb93e003135cdacc3e4cbf5b6a464bb3f46750c1466f1ddcffd265f52abf74951eda632d7b31dbd0b7e38c0d99741

Download Submit
C:\Program Files (x86)\sigma\oxyinstaller.exe

Filesize
325KB

MD5
f65b6e70becdeafa363cd101646a0602

SHA1
1c6ebde3a18aa9ba02202e8ef4139f6c8bbf0c68

SHA256
e304be47ba6bd5a80284e6750f4c97181134e9daa0f581c8c47a665084e49555

SHA512
409601c4f5f8c4856d77aded96d466f3f9f057bf1edd635de8db42a946478aed467145249bdc6243d2df0172007b76345550b937d8191c403806ce0a755f21fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d8cb3e9459807e35f02130fad3f9860d

SHA1
5af7f32cb8a30e850892b15e9164030a041f4bd6

SHA256
2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

SHA512
045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6ca03841a619868438b436bbaba21ab4

SHA1
11bd79a4267e2c942c92f20a319780ae1fa6cadb

SHA256
b5d9415a62623fcd6fdd244e361a2126a30b22e2758e2797a8d1b228291ca72b

SHA512
4c89eff38a7cb9583818332ad04ce2564b8b3733b5771210814e37347a485fa0127095c15e9524028709ed20b298991c5a40efb42ea5724206d9cae5cc529bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vvrsuvs5.4au.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/916-65-0x00000146D90B0000-0x00000146D90D2000-memory.dmp

Filesize
136KB

Download
memory/1020-95-0x000001E6BD480000-0x000001E6BD69C000-memory.dmp

Filesize
2.1MB

Download
memory/1268-22-0x0000022C40DF0000-0x0000022C40E42000-memory.dmp

Filesize
328KB

Download
memory/1268-58-0x00007FFE25E00000-0x00007FFE268C1000-memory.dmp

Filesize
10.8MB

Download
memory/1268-57-0x00007FFE25E00000-0x00007FFE268C1000-memory.dmp

Filesize
10.8MB

Download
memory/1268-23-0x00007FFE25E03000-0x00007FFE25E05000-memory.dmp

Filesize
8KB

Download
memory/1664-83-0x00000273A4790000-0x00000273A49AC000-memory.dmp

Filesize
2.1MB

Download
memory/4076-39-0x00007FFE25E00000-0x00007FFE268C1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-26-0x0000000000BD0000-0x0000000000C28000-memory.dmp

Filesize
352KB

Download
memory/4076-111-0x00007FFE25E00000-0x00007FFE268C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads