Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 01:37

General

  • Target

    843d1069d0acfd77f82eb9ac4f3d9d0ef4827aefa080c82570162ace6e7e30c5.exe

  • Size

    1.2MB

  • MD5

    508b401d8d7a56da01c8712b088298ef

  • SHA1

    05ac6bee5f650f3505fd542bdb7631bc755a2a34

  • SHA256

    843d1069d0acfd77f82eb9ac4f3d9d0ef4827aefa080c82570162ace6e7e30c5

  • SHA512

    c1b3b28ac58f613705cf048fd23f1d04733e7f5ebd213915e4132ed05f0bcf239f9e41790ece618a987ebf64bce3569f068e7d9d9198bce0b71b14f907e6a66a

  • SSDEEP

    24576:XbDbhxpUABuuc7eLldwcdECl7xpVlMKnKoAjBt6jodgbKmp+rRwjT332f:reAnrcciEpT1KoAjB6od8KmJTn2f

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/899272326225489931/bx_ZitvINloyS_p7Mt8ypSdpcHyTlkZQ94mZqgQV-8qhAi4mpNWm2GpwtHDA8yg8VYmd

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • 44Caliber family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\843d1069d0acfd77f82eb9ac4f3d9d0ef4827aefa080c82570162ace6e7e30c5.exe
    "C:\Users\Admin\AppData\Local\Temp\843d1069d0acfd77f82eb9ac4f3d9d0ef4827aefa080c82570162ace6e7e30c5.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt

    Filesize

    105B

    MD5

    2e9d094dda5cdc3ce6519f75943a4ff4

    SHA1

    5d989b4ac8b699781681fe75ed9ef98191a5096c

    SHA256

    c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

    SHA512

    d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

  • memory/2228-0-0x00000000011D0000-0x000000000157C000-memory.dmp

    Filesize

    3.7MB

  • memory/2228-1-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

    Filesize

    4KB

  • memory/2228-2-0x00000000011D0000-0x000000000157C000-memory.dmp

    Filesize

    3.7MB

  • memory/2228-11-0x0000000074BA0000-0x000000007528E000-memory.dmp

    Filesize

    6.9MB

  • memory/2228-57-0x00000000011D0000-0x000000000157C000-memory.dmp

    Filesize

    3.7MB

  • memory/2228-58-0x0000000074BA0000-0x000000007528E000-memory.dmp

    Filesize

    6.9MB