Analysis

  • max time kernel
    93s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 22:10

General

  • Target

    4b1765e35f418e7a5698fd5709c11b98c6c4aff2637db48a7ad7b59a14b67b8b.exe

  • Size

    646KB

  • MD5

    2eddb25910e24b0aec14096ec42cd9c8

  • SHA1

    8f7a1c205e3b9447d3a433ff5712e0fdd95b7b26

  • SHA256

    4b1765e35f418e7a5698fd5709c11b98c6c4aff2637db48a7ad7b59a14b67b8b

  • SHA512

    986c09949f1c1dad7a57ef95e02f47f58e954ff42d1728fae4ee054fe70d9a45504f78654304307b8c0e1c9e98a97302bd6c2f7b581ed11aa40f9d4e81bdc09a

  • SSDEEP

    12288:pxb63VILe4Ni8zGQa13Rsatd36JBH2YQeQd6m24AWtuzJNvAMNyaS/h:pxe3VIS4N9zGQaJRsUYznXjSiCiy

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1120478623254708224/cU4HxqyVDvr-lsj-hl3z5Ir-g2JNSHG6NQxON392Hdg4s-byv9nMxsyir7Kylc5QEWVh

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • 44Caliber family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b1765e35f418e7a5698fd5709c11b98c6c4aff2637db48a7ad7b59a14b67b8b.exe
    "C:\Users\Admin\AppData\Local\Temp\4b1765e35f418e7a5698fd5709c11b98c6c4aff2637db48a7ad7b59a14b67b8b.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Users\Admin\AppData\Local\Temp\Windows (2).exe
      "C:\Users\Admin\AppData\Local\Temp\Windows (2).exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Users\Admin\AppData\Local\Temp\Windows.exe
        "C:\Users\Admin\AppData\Local\Temp\Windows.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    548B

    MD5

    4c546752960f34c5e10b21c92957f625

    SHA1

    3e680f17bd8ff8c946d4f5dd503b6a230345714e

    SHA256

    0b8129695068c5a276ee40770e26af1ee8f09b45890eb257f7ccbfa5236d7dc7

    SHA512

    8f803d369ba9226cd770be8872ad67ea88b3a99cd2fb2a285336e12040a479025e6de92832ee362c254f2aa667536c6c5c404627b99dc346e8cb83dc5640f0d5

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    764B

    MD5

    97579a0e07607bbfda7d98137276a6a4

    SHA1

    5e58a07f3c293a770f2b903e4bd68c8397aeda2a

    SHA256

    13e16059272e24249b1c00b889049ee50ff7a886a3f37039d182ac14cfc59442

    SHA512

    be509b379699fb9e8ff9cbeca17055e2760da43690bf8fd1b0df24953ea48bdbe358b59c5fbbb1acfd9daeb2be387c7b6d8c433c58aece6cffc0288deaa9517f

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    1000B

    MD5

    7fc767288adccc59615311855a8e36be

    SHA1

    8784fef700c1cdf9b3ac7419c7ad0e7dfb508c9e

    SHA256

    23c8dfb302ebb4a4bba00faba33750bed64a62a4949903c6562a13f0f32d88dc

    SHA512

    61ce8e52084479d72b687bdbd8dfa2de9649d8535f66558e3f0c9d146a314a749ce3a58b4959241cf4f6829cade641b87429dfc2bac382818d7b2ee238d55133

  • C:\Users\Admin\AppData\Local\44\Process.txt

    Filesize

    1KB

    MD5

    b5142382ba8b82d40496be280f75daf8

    SHA1

    c0cd61a6c9573c668eb00c5e350be95614da726e

    SHA256

    a8d31aabb3436eb04f4a3178df9d82215993a73a5b194d8e8a7471df6d10c334

    SHA512

    5d85a445eb0432a444db60a7d6435b2d4b4fa5a60231d230573d34bedd3e76f6151ab6312530d2aab0c8b70b3edc7d8526ed0f90e2c1f2bd1e102aa613566290

  • C:\Users\Admin\AppData\Local\Temp\Windows (2).exe

    Filesize

    540KB

    MD5

    ff406dfb1d83072ed678d823b5bc263c

    SHA1

    25f025bfc7297253817997db50b0970d863095e3

    SHA256

    dd1612a4bcd13f52a832f4759cfc0b6905b617445dbf36cde4495db5c647d178

    SHA512

    e9217f9c8b3167309b7f9dcc62f97140ee6791b7850dd1b27874df1d021c7cb7afe2bee7e5d41d33731e6dde7bc004cee092e1fa007d76af910806fa678804d2

  • C:\Users\Admin\AppData\Local\Temp\Windows.exe

    Filesize

    274KB

    MD5

    4fc218b2cfdb1ad177f035002cdcaddd

    SHA1

    e0ccc3dcac93a0c9e14799217bc5dff557d5079b

    SHA256

    c1996926fd51f8418e9095057b145e173b2b182c33c12aebd36500446ef0c55d

    SHA512

    d114ec692399ee7b9b5cd8b7e88e6e6c0a70569d910a2ba7ef8ec3c56aa23267a60d991dca33a66ece270ae882c65735c1a144a65bebd0d7c618262f4569e5ef

  • memory/532-3-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

    Filesize

    10.8MB

  • memory/532-39-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

    Filesize

    10.8MB

  • memory/532-4-0x00000000034A0000-0x0000000003530000-memory.dmp

    Filesize

    576KB

  • memory/532-0-0x00007FFB40EF3000-0x00007FFB40EF5000-memory.dmp

    Filesize

    8KB

  • memory/532-2-0x000000001C430000-0x000000001C504000-memory.dmp

    Filesize

    848KB

  • memory/532-1-0x0000000000860000-0x0000000000906000-memory.dmp

    Filesize

    664KB

  • memory/3812-52-0x000001DA172D0000-0x000001DA1731A000-memory.dmp

    Filesize

    296KB