Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-uk -
resource tags
-
submitted
18-08-2024 09:53
General
-
Target
Inject.exe
-
Size
303KB
-
MD5
f5a2f1da8fcc5e51cc8eec426fa3e545
-
SHA1
da3c79d8d5e6584d3adbd71912291d18681ee109
-
SHA256
66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9
-
SHA512
ea3f4b03b149f97e500679d0667b5c1c7b66db242ef27c8520f4b86a5e706ca8424d49ec154cebe90ec1643bbe1a4c5f5e82261ec5f77137e408e8428bc13ec9
-
SSDEEP
6144:HtBuT6MDdbICydeBPKqCBu19FsN6LmA1D0CKU:HtaSqCBu/Few1DUU
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1259819169050923028/FgFc46vkD5YoeeRf3p_mErGG96JCipzz-kU6-Gb301GlKvAaNpgaDswVn7i9JLTzy5-c
Signatures
-
44Caliber
An open source infostealer written in C#.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inject.exe"C:\Users\Admin\AppData\Local\Temp\Inject.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
328KB
-
Filesize
10.8MB
-
Filesize
10.8MB