Analysis
-
max time kernel
133s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-11-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
123.scr.exe
Resource
win7-20240903-en
General
-
Target
123.scr.exe
-
Size
549KB
-
MD5
2cd8134f58cdbda71373f5ea79d5a422
-
SHA1
f30cc8c8056e6943a4114e557615552f16cb8e2f
-
SHA256
7e00639b962e167ab8463fa871f8fe12f6e38166a497d7ed8cf3a2370053d1f0
-
SHA512
a6042ab229429830a0e98b17873b68b4799ccde6637e55ff7bbf94eaa6af0d4f89e019fea67a04a04550889be89a3db701372978584569cdd350e86a6a2f65a0
-
SSDEEP
12288:nYhJzH0hGN8nVY5cdFWOh+0H0uc1k7EIKxih+sgPrv6KfNcyFEOYw76:YfwM+nVMcPVY0U7qHKxugjdeyFm
Malware Config
Signatures
-
44Caliber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 freegeoip.app 6 freegeoip.app -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 123.scr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 123.scr.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1408 123.scr.exe 1408 123.scr.exe 1408 123.scr.exe 1408 123.scr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1408 123.scr.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
289B
MD5fd205a2e70001403e9f486ab8736a6fc
SHA1ce5c9c14a94d99f313bf01fcc9fa4acd6da13d3b
SHA256f19e442e9f9e393d247b445cd93cc87b3c5b5e4a2d971a35647a42baec799988
SHA51243cb8728a11f1bb4ee12f9e7bdf6aab5ef273dad6e04c2777a10a27f51a001fd6babbdd6b1dc773089cdfe85108deef7d0968b08049d2856011bd73426b751b3
-
Filesize
742B
MD5ac993dd3915ba1441b7d603e9aa6c16c
SHA1133d83311cbae856fea0fdb98cca61442a52e472
SHA2569182da3b6c5e1763e8c1496933b51581cecb3c335456401705ce1dc0ea396e16
SHA512472629fded998697246d0abaa4f487e369a503591927c21423564e44a870c7e672651d9561a09fb3afc498ef7f35a827d1c3de89fe55739da5777c6d9ceb887a
-
Filesize
1KB
MD587d2e690517f0dc66855362d3c3ebfaf
SHA15b1f1410df9e5bf230bd8e8317ebd585fdf7e329
SHA2569d9ad3c4d046c8a0a55d217469c94f0aaca42190d853d9d46dbdd5c09f258a5b
SHA5128fd8ce44a6050e329c528b0d69bf7f265d6e4187ea7ca7c9b292d5b7c096f105d02b30990a8c78b3bd8b7ea4dcf2e1f4ede1177804ebf84d088c493ba4f4a327