Analysis

  • max time kernel
    94s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2024 01:37

General

  • Target

    843d1069d0acfd77f82eb9ac4f3d9d0ef4827aefa080c82570162ace6e7e30c5.exe

  • Size

    1.2MB

  • MD5

    508b401d8d7a56da01c8712b088298ef

  • SHA1

    05ac6bee5f650f3505fd542bdb7631bc755a2a34

  • SHA256

    843d1069d0acfd77f82eb9ac4f3d9d0ef4827aefa080c82570162ace6e7e30c5

  • SHA512

    c1b3b28ac58f613705cf048fd23f1d04733e7f5ebd213915e4132ed05f0bcf239f9e41790ece618a987ebf64bce3569f068e7d9d9198bce0b71b14f907e6a66a

  • SSDEEP

    24576:XbDbhxpUABuuc7eLldwcdECl7xpVlMKnKoAjBt6jodgbKmp+rRwjT332f:reAnrcciEpT1KoAjB6od8KmJTn2f

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/899272326225489931/bx_ZitvINloyS_p7Mt8ypSdpcHyTlkZQ94mZqgQV-8qhAi4mpNWm2GpwtHDA8yg8VYmd

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • 44Caliber family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\843d1069d0acfd77f82eb9ac4f3d9d0ef4827aefa080c82570162ace6e7e30c5.exe
    "C:\Users\Admin\AppData\Local\Temp\843d1069d0acfd77f82eb9ac4f3d9d0ef4827aefa080c82570162ace6e7e30c5.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    1KB

    MD5

    ef80d341ac9624d1e5de981b9bc0507d

    SHA1

    a0379e07268164fe0c5ef23641520a68f3604d94

    SHA256

    bfd5a4f6fe9cfd9ad14f8c8c83863263c49766e72a135bef2d2bb728658a5a19

    SHA512

    3f09ae1730949958fe6e60669ab57ac0b9b7f186baf1d64f70e5bbf547812538fe8fb7bdec68b6ab999e02a4ca14f2e535e6c9d6d56e2c8f049e1ff215438fbd

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    292B

    MD5

    556109c3c98e878e6965d156f02aa62b

    SHA1

    432edab2a3ebf896c5568b9db071b366586d052e

    SHA256

    b05e460fed5f8523d9912a732968e68ce9ccefb1c416b7def95fc531697570c6

    SHA512

    a810a3ea3fc27efbddc8ad76c8a59cbafb03e40b2171c5de2f82b9781b4450703d76f8b7a88136c7a2bd3ff8e360c63e5da0e3c6b25ee4979cc8ebf113176f4b

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    745B

    MD5

    03069566412f3973b44465eafb260eba

    SHA1

    53e9d00dfb53bbae93ae60e5969075f177f7e124

    SHA256

    3e3297f3ea8981ec929ad286d11f189330bc96b3ded19d04a61f87d685c82d6f

    SHA512

    42204aa7a9eb8119b32e5d7a3635d703e9e068faf8e6fc96a7b2703a81144a25609e2e71c45032bc863f573b4a15970c627f8fe6f22498f92f4d367c06d32b3a

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    1KB

    MD5

    7dfe80d519436633da244b7fffb1942c

    SHA1

    ff85d65f99a6614785906305a634cbeb59a5d268

    SHA256

    f89dba77b74561636fd3f3514e5c11b2ae9e7c586297a678538fe04607bea16f

    SHA512

    3ec972f1442db501d0989f174b59178b3b605beee4e36cc7329995b8209eb9a1a9b33fd64567471211ee58c6499a1e4f176f4026ae05eeb9a93b360a52d7de81

  • memory/776-2-0x0000000000590000-0x000000000093C000-memory.dmp

    Filesize

    3.7MB

  • memory/776-7-0x0000000074360000-0x0000000074B10000-memory.dmp

    Filesize

    7.7MB

  • memory/776-18-0x0000000006240000-0x00000000062D2000-memory.dmp

    Filesize

    584KB

  • memory/776-39-0x0000000006D10000-0x00000000072B4000-memory.dmp

    Filesize

    5.6MB

  • memory/776-0-0x0000000000590000-0x000000000093C000-memory.dmp

    Filesize

    3.7MB

  • memory/776-1-0x000000007436E000-0x000000007436F000-memory.dmp

    Filesize

    4KB

  • memory/776-123-0x0000000007D70000-0x0000000007DD6000-memory.dmp

    Filesize

    408KB

  • memory/776-127-0x0000000000590000-0x000000000093C000-memory.dmp

    Filesize

    3.7MB

  • memory/776-128-0x0000000074360000-0x0000000074B10000-memory.dmp

    Filesize

    7.7MB