Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 03:03
General
-
Target
93d019a96cfeb007a6baf5b8d463ebf36bc5dbaabe213e7df6189d566f813e82.exe
-
Size
1.2MB
-
MD5
b3cdce3b009f3e939234082945e89807
-
SHA1
7129f64c79954ba3e764efd44eaf3567a541ccac
-
SHA256
93d019a96cfeb007a6baf5b8d463ebf36bc5dbaabe213e7df6189d566f813e82
-
SHA512
97ab0bc727fac0e3d5a5231266fc5de257f3ddbc614990ed487e41897847ceaf2e027e9f2e93fb44f077532e87f472d902b7f3ba70b75db904a66f706a428ecd
-
SSDEEP
24576:gFtCQinvekY81UmRAOO0+B+i/rOjX25RxQps2ARjTjMpXCYmJS:Wv5mRfO9bzOjX21QJA9H6CYX
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/899702716115329035/bngOeqo8LUOszmsJtzqpLnMtfNXAZr9oXhUZ9DwQPgZG1cj1Y0F0qgN18O94CQ_gvLSj
Signatures
-
44Caliber
An open source infostealer written in C#.
-
44Caliber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93d019a96cfeb007a6baf5b8d463ebf36bc5dbaabe213e7df6189d566f813e82.exe"C:\Users\Admin\AppData\Local\Temp\93d019a96cfeb007a6baf5b8d463ebf36bc5dbaabe213e7df6189d566f813e82.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
425B
MD5850567f267d70c9198dd9015f6959242
SHA170a668b9ee665025a3ec3f81ab48d2b56cac7d89
SHA256f2c5f685deed209fc068db10d3fcd4fbeab7e037393e40d901b3c8c434e3fbb3
SHA5129a045c42fc745f41c64d97c7f5cc16eaf78b471b4cb8abeb279d9dec047e108906b319dc8da822ea04d95c582272111ec40e4cdd145c66fb92de010aec0ed491
-
Filesize
440B
MD5fbf65a1aaba3fea5b99ed101d7014e4b
SHA144b4c508cf6d5aedc40bb0bc00042b113db76851
SHA256d9c40761f27704a63c82d3ee015123e3169e2406ccc66febe8083c66192c5296
SHA5127c0e88d2a6cce3211f23926b8efe9b1a11401fa17dde02a802320f38bca3bb76d87d0471b6850e8995a4e63200d31be5e53508c33b9906deca01bdbcf9496a30
-
Filesize
792B
MD5f57170906e9b409068d64cd42806ce4f
SHA1919fba817b3cc943e6f35f7ddc9e8b70e88690ad
SHA25615a3024dffbd8f76b7f1250cef0ad036391ef8a8fad2803663440d5877c91a29
SHA51260819df42006233b6cff64bada2fe0d4730f95dc13d982b5aeb48185e7155e5509edce7fa5efd1c2c4df05bf257fc74de70c2cf30af7ee06335c51977c3ab244
-
Filesize
1KB
MD5688108c395323fc0795a2ef7b8b3c7a4
SHA10d9a9535d3963afe3dd7cb99adeb817f4e1560f6
SHA256d083fab5500949c09aa0180a4489f788c02f2bffb827fbf7ed0f62f702858d98
SHA512040eed7fb0b5207a042164e9d3b61009debde6a88db2ac5db615b3fcce41eabb42c270ba02c7d97751cb145cc8c4cad68b0d9bffe792bdead8ea136b61eacf31
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
3.7MB
-
Filesize
7.7MB