Analysis
-
max time kernel
30s -
max time network
16s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
26-06-2024 10:17
General
-
Target
Loader.exe
-
Size
304KB
-
MD5
f896c2bfec649637e85c463e3a70b2a6
-
SHA1
04d65945a3b79ee5b48a7e7e22fd24c8198fe332
-
SHA256
d4917f32cf3755b07badf1179d6717d4f17618cb68184f0dda48f4a4bbb45376
-
SHA512
0fed9a755f93198e795aac73aff0e17478cd51ffb9c19f80fdfdaf53374b32e2016bf83f0415f253b6f76e736cb36fad5269021d73972749c3d3d84206c6ebe0
-
SSDEEP
6144:bFcT6MDdbICydeBvtCikGW9mhL8PzeVAOe044E:bFK1CikGemQHOeGE
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1255437795820966010/0VVoLF2QZxnBkoGw_P4ovEIbuHZLKgsoVU8zu2nEJgchI5ahmWwv98_frx1Jjvk7GNic
Signatures
-
44Caliber
An open source infostealer written in C#.
-
BlackGuard
Infostealer first seen in Late 2021.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50f89d882a626748e8834d3ffd8321d6d
SHA1161757dc4eaeb7b300c202cb5087b17cfcbb33b5
SHA25691e68b7af0f207f7dc355071d0579ec7a3a05ef1ef80ad844464569674280281
SHA51298f675527b9b3090d94181458829134c3ca1d07b2fd9831cf883065b2b5c6b6da1c9d5230c554b7ff947462e48a913c272f656d7bc19a50a9d123091ef6df45d
-
Filesize
1KB
MD53686856a864cfd5df04e2911ed2eb56d
SHA1653a8078007b856670ff41530f96c35cb3e21153
SHA2560bfe2db65075c9720f3c9abbe047f63797be04d252aa57f811b307d1370be52f
SHA51283b6ab8e02b12189c98d72b4555d3abd0d3bdb4ed7b2addcf973779af8ba18da2e58412de89c79690c87f82b48d40cadf39cc9272e4555d97f91341125e95ec3
-
Filesize
328KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB