Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 09:56

General

  • Target

    66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9.exe

  • Size

    303KB

  • MD5

    f5a2f1da8fcc5e51cc8eec426fa3e545

  • SHA1

    da3c79d8d5e6584d3adbd71912291d18681ee109

  • SHA256

    66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9

  • SHA512

    ea3f4b03b149f97e500679d0667b5c1c7b66db242ef27c8520f4b86a5e706ca8424d49ec154cebe90ec1643bbe1a4c5f5e82261ec5f77137e408e8428bc13ec9

  • SSDEEP

    6144:HtBuT6MDdbICydeBPKqCBu19FsN6LmA1D0CKU:HtaSqCBu/Few1DUU

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1259819169050923028/FgFc46vkD5YoeeRf3p_mErGG96JCipzz-kU6-Gb301GlKvAaNpgaDswVn7i9JLTzy5-c

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9.exe
    "C:\Users\Admin\AppData\Local\Temp\66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 448 -s 1192
      2⤵
        PID:2704

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/448-0-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

      Filesize

      4KB

    • memory/448-1-0x0000000000B30000-0x0000000000B82000-memory.dmp

      Filesize

      328KB

    • memory/448-19-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

      Filesize

      9.9MB

    • memory/448-20-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

      Filesize

      4KB

    • memory/448-21-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

      Filesize

      9.9MB