Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 03:08
Behavioral task
behavioral1
Sample
d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe
Resource
win7-20240903-en
General
-
Target
d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe
-
Size
303KB
-
MD5
5c6721a4445b1ad34affb5d66c987573
-
SHA1
d2f20db4d9a3fd2e72a0545926b6fee1f3283d47
-
SHA256
d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82
-
SHA512
15c3d229c7ad3e2036405c68f7f59f03cf774348e89d7fdf04cf0c1220c34cd6029bb5b96a5084a056cb4aadab2474a915a0c0640015e5ccd30c472a68a2e085
-
SSDEEP
6144:PjFT6MDdbICydeB0iG54G4S+ZoH86jmA1D0/Hx:PjzQ54G4SuocY1Dsx
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1303704145731260446/-6ntBnd7ROApHmCsRB7Lli7gKTsLyWRgcOJ-cJbRXh5PQKViLyldpkyDBWbuBRUun_nd
Signatures
-
44Caliber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2440 d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe 2440 d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe 2440 d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2440 d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2808 2440 d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe 30 PID 2440 wrote to memory of 2808 2440 d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe 30 PID 2440 wrote to memory of 2808 2440 d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe"C:\Users\Admin\AppData\Local\Temp\d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2440 -s 10042⤵PID:2808
-