Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 23:57
Static task
static1
Behavioral task
behavioral1
Sample
2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe
Resource
win7-20241010-en
General
-
Target
2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe
-
Size
606KB
-
MD5
59123841ec7ab6b96cce25007768d602
-
SHA1
97d9974813a885ce0427e95a821aec36308534fd
-
SHA256
2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33
-
SHA512
959504d40a506f9c7a3aff0d00116f5e6c690be51d7deda85ce45917c1b5c91cb4ec59e257bd2fa66b518f2c291ce9dc2217c49b2925008b1bb2cc4d4abccfbc
-
SSDEEP
12288:QZo9wqaX9lAytIcWlkhfMZVJt3uITOI7RxKPgcMQolSIBxzQQUpCW31R:ZaX9lAytIclhEJkIT7igcNjIB5Qgw
Malware Config
Signatures
-
44Caliber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 freegeoip.app 4 freegeoip.app -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4860 2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe 4860 2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe 4860 2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe 4860 2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4860 2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe"C:\Users\Admin\AppData\Local\Temp\2d936a38e8c1094b42769f128030b1dc3c110c7a5abb8fa1ac3842a76dba7b33.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57af0fcb2bc6365a97066fa771faf0710
SHA1a0f0b5751ecb3c820a2d49685a38a4da26da81f7
SHA256530b3cfe11feef4e019825c97a2260cbd39df4257a57f0d449ca898f49562e1c
SHA512da81d7af301497fb2d002269a09b6af818e97efcfa636d9b5f48f7c870b66a53186fb78aead5f9c93dbd9e89de1955ed07c9cb0c927b40175be35a37af10c70b