44caliber | 8286320ef9512e12cd838e2e3e051704d62d522742659afbb3ca19f8c444a04d

Analysis

max time kernel
43s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PWN.AC/PWN.exe
Size

407KB
MD5

8a6e04cab1aea1c66325afbc422cd361
SHA1

3ad3b8d7a22767bdeb042c8668b563f9090ed1ab
SHA256

aa6c9986b5a8e300b60ef090c5f5506760c5d013721b4670376f09e6005a1479
SHA512

cd00a32c9946b8fe57ddd4800df185648fde6bb0eb042696c7f2af97a4092ef5ba6aa54469bf71f789ffb90e281746590ed3b58fed1c1eb3c2933f72e1660949
SSDEEP

6144:jXt3T6MDdbICydeBimcmXKhJUP+6rmA1D0fhRc:jXttpcmXKnUWQ1DqRc

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1215310807202799627/6HZ5IcWVou3y3RCr0gjeX5IP6YAHlSQA7mqRUnFxpGoxTLuwlGoDnHwKUfc_nm07jkPK

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 freegeoip.app
1 freegeoip.app
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PWN.exe

pid process

4628 PWN.exe
4628 PWN.exe
4628 PWN.exe
4628 PWN.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PWN.exe

description pid process

Token: SeDebugPrivilege 4628 PWN.exe

flow	ioc
3	freegeoip.app
1	freegeoip.app

pid	process
4628	PWN.exe
4628	PWN.exe
4628	PWN.exe
4628	PWN.exe

description	pid	process
Token: SeDebugPrivilege	4628	PWN.exe

C:\Users\Admin\AppData\Local\Temp\PWN.AC\PWN.exe
"C:\Users\Admin\AppData\Local\Temp\PWN.AC\PWN.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4412,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:1476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3824

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4628-0-0x00000206DE550000-0x00000206DE5BC000-memory.dmp

Filesize
432KB

Download
memory/4628-1-0x00007FFFE4253000-0x00007FFFE4255000-memory.dmp

Filesize
8KB

Download
memory/4628-28-0x00007FFFE4250000-0x00007FFFE4D11000-memory.dmp

Filesize
10.8MB

Download
memory/4628-29-0x00007FFFE4250000-0x00007FFFE4D11000-memory.dmp

Filesize
10.8MB

Download