Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 23:48
General
-
Target
2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe
-
Size
606KB
-
MD5
59123841ec7ab6b96cce25007768d602
-
SHA1
97d9974813a885ce0427e95a821aec36308534fd
-
SHA256
2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33
-
SHA512
959504d40a506f9c7a3aff0d00116f5e6c690be51d7deda85ce45917c1b5c91cb4ec59e257bd2fa66b518f2c291ce9dc2217c49b2925008b1bb2cc4d4abccfbc
-
SSDEEP
12288:QZo9wqaX9lAytIcWlkhfMZVJt3uITOI7RxKPgcMQolSIBxzQQUpCW31R:ZaX9lAytIclhEJkIT7igcNjIB5Qgw
Malware Config
Signatures
-
44Caliber
An open source infostealer written in C#.
-
44Caliber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe"C:\Users\Admin\AppData\Local\Temp\2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fc22d6fe015bd52de4a43aa81c8cba4a
SHA17af3a3db73313563bed56e0234d61bc3afda90d5
SHA256af28c2530b1421edb1ffc1c7a45e0d1404d6a4cee5eff101b4e7affd3e8b2c0a
SHA512dfb53eaa9e0af66302b6b90e33b224fdca8a958dd1b103b3d284dff7ab9d2b3ff30461793ac4269f56f8c9ab6cfef149f965e5d62cdbe38769146bb96628fd37
-
Filesize
747B
MD50f3e844bc73a7a287e6a9062f8daa45a
SHA191b664f8bd1be5ea7fee62722041c5c0ae53d8e8
SHA256bf02fd2fe5f6f94f0ebdc1c24382060de1c37394b25851432fd1cc76e46edca5
SHA512bbd58fd649c36b061f9a5d76ae48a7d977d65228f3a816b62c7370482b95d0e20b94bd25e143bd26f9375018693d8dfb4ee81e4f683ec120722221f7b4302440
-
Filesize
8KB
-
Filesize
632KB
-
Filesize
936KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
10.8MB