Analysis
-
max time kernel
136s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
26-06-2024 10:20
General
-
Target
Loader.exe
-
Size
304KB
-
MD5
f896c2bfec649637e85c463e3a70b2a6
-
SHA1
04d65945a3b79ee5b48a7e7e22fd24c8198fe332
-
SHA256
d4917f32cf3755b07badf1179d6717d4f17618cb68184f0dda48f4a4bbb45376
-
SHA512
0fed9a755f93198e795aac73aff0e17478cd51ffb9c19f80fdfdaf53374b32e2016bf83f0415f253b6f76e736cb36fad5269021d73972749c3d3d84206c6ebe0
-
SSDEEP
6144:bFcT6MDdbICydeBvtCikGW9mhL8PzeVAOe044E:bFK1CikGemQHOeGE
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1255437795820966010/0VVoLF2QZxnBkoGw_P4ovEIbuHZLKgsoVU8zu2nEJgchI5ahmWwv98_frx1Jjvk7GNic
Signatures
-
44Caliber
An open source infostealer written in C#.
-
BlackGuard
Infostealer first seen in Late 2021.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5905503b96191413ac840c8151145872a
SHA1b7f3831a116e918992211399bca762549ab08ae2
SHA2567ea76f97de7b29efc9950ef9adcb97ff54a0e3d0878f64df65ddc7e5294d27e5
SHA51208106f7a6159b372b0469e363c05413a0f62c6ccf4a8a8bb297d0674637bd8ee43db040850d7492f32e4ead05d112f720ad521b935fd406e36a91ee51363dca1
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
9.9MB
-
Filesize
9.9MB