Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 04:18

General

  • Target

    nitro_gen.exe

  • Size

    6.9MB

  • MD5

    fb4d683e3ae0f7d5e33df5bf301daa58

  • SHA1

    36a1de1d727c726aba7dab2b2937be337c538348

  • SHA256

    d684eb2255665b6953a3ce3f23721d4130987ffa61ad69482fd706392ab9bf3e

  • SHA512

    ccb13161a680f80fd6e93956bc50d3c070c344c36096118240b2159cdbf6ad866fb68b0257e8bbd156cec5dbf77195ef405ef1ddc0c92fa4d5166548b49d4554

  • SSDEEP

    196608:aaMDtIiXP2B0r3he64mCtabd1MEXltYYgsDG:aaUJtrReIHd1ME5Ri

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/854449200544481340/h9Qp-FHl7aROvxHN_j_GBe2W_7GEv-jYyr5ljRUrqO18MRY3RYt72njct-cF-n2sdbCe

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • 44Caliber family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nitro_gen.exe
    "C:\Users\Admin\AppData\Local\Temp\nitro_gen.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Users\Admin\AppData\Local\Temp\main.exe
        "C:\Users\Admin\AppData\Local\Temp\main.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          4⤵
            PID:828
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            4⤵
              PID:292
        • C:\Users\Admin\AppData\Local\Temp\Insidious.exe
          "C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2196

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\44\Process.txt

        Filesize

        179B

        MD5

        a207f68cd7afee46a6a100b8740dda51

        SHA1

        f78a2853491f3c9bc7c0a64a2ec2906575537cd8

        SHA256

        1202ebc065fd0132ec6e9e840c7fa568bcfeef21432cc102d9fe1bb3f200fe99

        SHA512

        1ce2b0d64ee8435bdcda8bc3f43baa946c4547c4c7b13b21cbe7ca041d2f63159881b74e34c8bc2c938a48fcbcd14b4995259e5db3c649adc9f21713aea68b7a

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\VCRUNTIME140.dll

        Filesize

        87KB

        MD5

        0e675d4a7a5b7ccd69013386793f68eb

        SHA1

        6e5821ddd8fea6681bda4448816f39984a33596b

        SHA256

        bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

        SHA512

        cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\_hashlib.pyd

        Filesize

        44KB

        MD5

        a6448bc5e5da21a222de164823add45c

        SHA1

        6c26eb949d7eb97d19e42559b2e3713d7629f2f9

        SHA256

        3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a

        SHA512

        a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\_lzma.pyd

        Filesize

        246KB

        MD5

        37057c92f50391d0751f2c1d7ad25b02

        SHA1

        a43c6835b11621663fa251da421be58d143d2afb

        SHA256

        9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764

        SHA512

        953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\_queue.pyd

        Filesize

        27KB

        MD5

        44b72e0ad8d1e1ec3d8722088b48c3c5

        SHA1

        e0f41bf85978dd8f5abb0112c26322b72c0d7770

        SHA256

        4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e

        SHA512

        05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\base_library.zip

        Filesize

        758KB

        MD5

        19d34805782c4704d1e2a81fe32e9c27

        SHA1

        8c3d99a0616abc478d6230d07f9dc7b38313813e

        SHA256

        06f3c20b42de72e69e9c6b2f66f149f5a65161873e30d07129333f53858d97bb

        SHA512

        267b8db8751ea170cd2e04ff5a4d87b0b65edc6d251a8016c213c97bcd8f3a12d955fc25860147b303b153b00d0a41191c09ed24e6fd4b95cb34ae98009456a4

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\certifi\cacert.pem

        Filesize

        257KB

        MD5

        1ba3b44f73a6b25711063ea5232f4883

        SHA1

        1b1a84804f896b7085924f8bf0431721f3b5bdbe

        SHA256

        bb77f13d3fbec9e98bbf28ac95046b44196c7d8f55ab7720061e99991a829197

        SHA512

        0dd2a14331308b1de757d56fab43678431e0ad6f5f5b12c32fa515d142bd955f8be690b724e07f41951dd03c9fee00e604f4e0b9309da3ea438c8e9b56ca581b

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\libcrypto-1_1.dll

        Filesize

        3.2MB

        MD5

        bf83f8ad60cb9db462ce62c73208a30d

        SHA1

        f1bc7dbc1e5b00426a51878719196d78981674c4

        SHA256

        012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d

        SHA512

        ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\python38.dll

        Filesize

        4.0MB

        MD5

        d2a8a5e7380d5f4716016777818a32c5

        SHA1

        fb12f31d1d0758fe3e056875461186056121ed0c

        SHA256

        59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

        SHA512

        ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\select.pyd

        Filesize

        26KB

        MD5

        6ae54d103866aad6f58e119d27552131

        SHA1

        bc53a92a7667fd922ce29e98dfcf5f08f798a3d2

        SHA256

        63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88

        SHA512

        ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

      • C:\Users\Admin\AppData\Local\Temp\_MEI24442\unicodedata.pyd

        Filesize

        1.0MB

        MD5

        4c0d43f1a31e76255cb592bb616683e7

        SHA1

        0a9f3d77a6e064baebacacc780701117f09169ad

        SHA256

        0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8

        SHA512

        b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

      • \Users\Admin\AppData\Local\Temp\Insidious.exe

        Filesize

        274KB

        MD5

        5b8d83823531d567241106b9cec66d06

        SHA1

        4a34b951287719ca9558fea764262ec8af52f20d

        SHA256

        5a12b229ff508e7ecfecdaf3a52da45ec02160587ccb852646e72b789ada6ac5

        SHA512

        c7aceaad5b54a23de1f76691dc12184ae381d3dc7409fc582b30938273a09fb2f6538eef886aca5c871ae9243e4eaf399178e44d3cb47666f025ea31ce6b46fd

      • \Users\Admin\AppData\Local\Temp\_MEI24442\_bz2.pyd

        Filesize

        82KB

        MD5

        3dc8af67e6ee06af9eec52fe985a7633

        SHA1

        1451b8c598348a0c0e50afc0ec91513c46fe3af6

        SHA256

        c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929

        SHA512

        da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087

      • \Users\Admin\AppData\Local\Temp\_MEI24442\_ctypes.pyd

        Filesize

        120KB

        MD5

        f1e33a8f6f91c2ed93dc5049dd50d7b8

        SHA1

        23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4

        SHA256

        9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4

        SHA512

        229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

      • \Users\Admin\AppData\Local\Temp\_MEI24442\_socket.pyd

        Filesize

        77KB

        MD5

        d6bae4b430f349ab42553dc738699f0e

        SHA1

        7e5efc958e189c117eccef39ec16ebf00e7645a9

        SHA256

        587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef

        SHA512

        a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

      • \Users\Admin\AppData\Local\Temp\_MEI24442\_ssl.pyd

        Filesize

        115KB

        MD5

        8ee827f2fe931163f078acdc97107b64

        SHA1

        149bb536f3492bc59bd7071a3da7d1f974860641

        SHA256

        eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4

        SHA512

        a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

      • \Users\Admin\AppData\Local\Temp\_MEI24442\libffi-7.dll

        Filesize

        32KB

        MD5

        4424baf6ed5340df85482fa82b857b03

        SHA1

        181b641bf21c810a486f855864cd4b8967c24c44

        SHA256

        8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79

        SHA512

        8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

      • \Users\Admin\AppData\Local\Temp\_MEI24442\libssl-1_1.dll

        Filesize

        670KB

        MD5

        fe1f3632af98e7b7a2799e3973ba03cf

        SHA1

        353c7382e2de3ccdd2a4911e9e158e7c78648496

        SHA256

        1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b

        SHA512

        a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

      • \Users\Admin\AppData\Local\Temp\main.exe

        Filesize

        6.7MB

        MD5

        53476f1737d178939ad93e38465fddd6

        SHA1

        5c8dde18b9d4b5d8c72de85d5f613dbfd77fe5b2

        SHA256

        b2b71248264c08ba56ed8d39f72e6811fea58d110bcae39381e18bf3fd387d43

        SHA512

        d01aa9891808b20cb891d816affca0eaac1ba2e8d768d03d56a03eb1e1905de93a9fc9960d098150c53dcc5abde36c0fd0754a4725e554b95ee13e5e90b4bee3

      • memory/2196-14-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

        Filesize

        4KB

      • memory/2196-33-0x00000000001E0000-0x000000000022A000-memory.dmp

        Filesize

        296KB