Analysis
- max time kernel
96s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
02/08/2024, 16:41
General
- Target bb6f6cb9b7597a2c7f6cd43f0d5a4d00N.exe
- Size 603KB
- Sample240802-t7dthswfjh
- SHA256 18143d02f3cb2e83ae05d73f1f689b80b391f3466acd18dcbc021e1db7d40ee6
Score
10/10
Malware Config
Extracted
Family
-
44caliber
C2
-
https://discord.com/api/webhooks/1267968855829905480/cd8VhmflrMNSQlpEWSs3J3IgzJ2PtIhkWjXFZEHp3Mu4ug7xMvzT3DehOE9cFtYpx_aB
Signatures
- 44Caliber
An open source infostealer written in C#.
- BlackGuard
Infostealer first seen in Late 2021.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb6f6cb9b7597a2c7f6cd43f0d5a4d00N.exe"C:\Users\Admin\AppData\Local\Temp\bb6f6cb9b7597a2c7f6cd43f0d5a4d00N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2208-0-0x00007FFE50593000-0x00007FFE50595000-memory.dmp
memory/2208-1-0x0000021F549A0000-0x0000021F549EA000-memory.dmp
memory/2208-2-0x00007FFE50590000-0x00007FFE51051000-memory.dmp
memory/2208-3-0x00007FFE50590000-0x00007FFE51051000-memory.dmp
memory/2208-4-0x00007FFE50590000-0x00007FFE51051000-memory.dmp
memory/2208-5-0x00007FFE50590000-0x00007FFE51051000-memory.dmp
memory/2208-7-0x00007FF75D850000-0x00007FF75D8F1000-memory.dmp
memory/2208-8-0x00007FFE50590000-0x00007FFE51051000-memory.dmp