44caliber | a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe
Size

274KB
MD5

ec34999e9a72c881a1f8a2b62f2a2f40
SHA1

e88e76616617e2d57d5a3b2d8767834ea5f503e4
SHA256

a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27
SHA512

f92a988c25415a72a55527b9ad4ccb095fef8592d4fb34ee14a243d1d0b4cc696e9867f62b25d5564c019c623444b5f277961830f78f3dc20f52a9fa28972e4f
SSDEEP

6144:df+BLtABPDLgj1xw1eO5rbMMzhgUsYqTXGR1afTyclI1D02SI:6161eO5rbHHsYqTXG9R1DUI

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

https://discordapp.com/api/webhooks/1165023408308883527/fHcVLlt-XS3bpeW4Pr9RnfIG-6FlU5L4fEDsBCSSGSwNqbsOngyplRsyoD4tshYENWIO

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
44Caliber family
44caliber
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	freegeoip.app
4	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3932	a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe
3932	a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe
3932	a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe
3932	a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe

C:\Users\Admin\AppData\Local\Temp\a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe
"C:\Users\Admin\AppData\Local\Temp\a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
ae9e4899b3818d252bf86975d2131d7d

SHA1
9a13febcec739e8606784132572399a7b874e224

SHA256
9232b8a6390d163c5c28a1a05a46b4ebe9d97248a6c39414eff725f2ddfab519

SHA512
722e428a0af1c9c2127441cefe34f638f13e25da65e6aec4b1a514328c246ed21614261e1fe6b17f144c2815f0c03334dd0232aa139caa9ddfe36cce767e8902

Download Submit
memory/3932-0-0x00007FFE58313000-0x00007FFE58315000-memory.dmp

Filesize
8KB

Download
memory/3932-1-0x000001F230110000-0x000001F23015A000-memory.dmp

Filesize
296KB

Download
memory/3932-32-0x00007FFE58310000-0x00007FFE58DD1000-memory.dmp

Filesize
10.8MB

Download
memory/3932-118-0x00007FFE58310000-0x00007FFE58DD1000-memory.dmp

Filesize
10.8MB

Download