Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-08-2024 16:41
General
-
Target
bb6f6cb9b7597a2c7f6cd43f0d5a4d00N.exe
-
Size
603KB
-
MD5
bb6f6cb9b7597a2c7f6cd43f0d5a4d00
-
SHA1
ca253eda80c20befdd614e32905eaf63d5173214
-
SHA256
18143d02f3cb2e83ae05d73f1f689b80b391f3466acd18dcbc021e1db7d40ee6
-
SHA512
1022513e26622175e8b3547749093a1312714746ea912c70b6ccb86ce77775517c858548e55ced735f9d16e6f2f5e6580a91c22e9940b355253a3ec10ce3d83a
-
SSDEEP
12288:SBe6DXqAB5jpx7RuZmdnnc6WSjHPv7zOsZUayLXfNd87hCn:SjD3P7RuodnncLOH/OsGNFdm
Score
10/10
Malware Config
Extracted
Family
44caliber
C2
https://discord.com/api/webhooks/1267968855829905480/cd8VhmflrMNSQlpEWSs3J3IgzJ2PtIhkWjXFZEHp3Mu4ug7xMvzT3DehOE9cFtYpx_aB
Signatures
-
44Caliber
An open source infostealer written in C#.
-
BlackGuard
Infostealer first seen in Late 2021.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb6f6cb9b7597a2c7f6cd43f0d5a4d00N.exe"C:\Users\Admin\AppData\Local\Temp\bb6f6cb9b7597a2c7f6cd43f0d5a4d00N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
296KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
644KB
-
Filesize
10.8MB