Analysis

  • max time kernel
    94s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 22:14

General

  • Target

    4b1765e35f418e7a5698fd5709c11b98c6c4aff2637db48a7ad7b59a14b67b8b.exe

  • Size

    646KB

  • MD5

    2eddb25910e24b0aec14096ec42cd9c8

  • SHA1

    8f7a1c205e3b9447d3a433ff5712e0fdd95b7b26

  • SHA256

    4b1765e35f418e7a5698fd5709c11b98c6c4aff2637db48a7ad7b59a14b67b8b

  • SHA512

    986c09949f1c1dad7a57ef95e02f47f58e954ff42d1728fae4ee054fe70d9a45504f78654304307b8c0e1c9e98a97302bd6c2f7b581ed11aa40f9d4e81bdc09a

  • SSDEEP

    12288:pxb63VILe4Ni8zGQa13Rsatd36JBH2YQeQd6m24AWtuzJNvAMNyaS/h:pxe3VIS4N9zGQaJRsUYznXjSiCiy

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1120478623254708224/cU4HxqyVDvr-lsj-hl3z5Ir-g2JNSHG6NQxON392Hdg4s-byv9nMxsyir7Kylc5QEWVh

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • 44Caliber family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b1765e35f418e7a5698fd5709c11b98c6c4aff2637db48a7ad7b59a14b67b8b.exe
    "C:\Users\Admin\AppData\Local\Temp\4b1765e35f418e7a5698fd5709c11b98c6c4aff2637db48a7ad7b59a14b67b8b.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\Windows (2).exe
      "C:\Users\Admin\AppData\Local\Temp\Windows (2).exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:116
      • C:\Users\Admin\AppData\Local\Temp\Windows.exe
        "C:\Users\Admin\AppData\Local\Temp\Windows.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Windows (2).exe

    Filesize

    540KB

    MD5

    ff406dfb1d83072ed678d823b5bc263c

    SHA1

    25f025bfc7297253817997db50b0970d863095e3

    SHA256

    dd1612a4bcd13f52a832f4759cfc0b6905b617445dbf36cde4495db5c647d178

    SHA512

    e9217f9c8b3167309b7f9dcc62f97140ee6791b7850dd1b27874df1d021c7cb7afe2bee7e5d41d33731e6dde7bc004cee092e1fa007d76af910806fa678804d2

  • C:\Users\Admin\AppData\Local\Temp\Windows.exe

    Filesize

    274KB

    MD5

    4fc218b2cfdb1ad177f035002cdcaddd

    SHA1

    e0ccc3dcac93a0c9e14799217bc5dff557d5079b

    SHA256

    c1996926fd51f8418e9095057b145e173b2b182c33c12aebd36500446ef0c55d

    SHA512

    d114ec692399ee7b9b5cd8b7e88e6e6c0a70569d910a2ba7ef8ec3c56aa23267a60d991dca33a66ece270ae882c65735c1a144a65bebd0d7c618262f4569e5ef

  • C:\Users\Admin\AppData\Roaming\44\Process.txt

    Filesize

    1KB

    MD5

    3d6673d8882c159a0fd49630f31d9eb2

    SHA1

    301d6fa91089ae78ab4d55bddb0f143f31cb1267

    SHA256

    34329d8cc5693e2fcac22465c3e07cd16b56c6a3490253a886d56f344badb4db

    SHA512

    9946a768f4c3525e0b89352a9ed993950fb9c6b139c140ef25781e848c000ed06f768a1cc0ff368a6b69cb5dcd22e6570aab744c27b08158c019a44cd2c1d57d

  • C:\Users\Admin\AppData\Roaming\44\Process.txt

    Filesize

    853B

    MD5

    dc6ee912403e68b5202482fa81b595e8

    SHA1

    cd4784409316230827cb039aca4afb821af9896a

    SHA256

    a78927fd926bcbba9b1c89f87b6466090a6424712ac509315f3b13d3c573d0ec

    SHA512

    1ad7c1724537f88b63a29f01d289f418754df947c5fbfd444b4cfb8b4bf215d861659020f1de36cfcc537026db6850802a3c39f77fb2ec222ec80c06ba3d11e8

  • memory/1668-0-0x00007FFF166E3000-0x00007FFF166E5000-memory.dmp

    Filesize

    8KB

  • memory/1668-1-0x0000000000430000-0x00000000004D6000-memory.dmp

    Filesize

    664KB

  • memory/1668-2-0x000000001BF10000-0x000000001BFE4000-memory.dmp

    Filesize

    848KB

  • memory/1668-3-0x00007FFF166E0000-0x00007FFF171A1000-memory.dmp

    Filesize

    10.8MB

  • memory/1668-4-0x000000001CCB0000-0x000000001CD40000-memory.dmp

    Filesize

    576KB

  • memory/1668-38-0x00007FFF166E0000-0x00007FFF171A1000-memory.dmp

    Filesize

    10.8MB

  • memory/3076-52-0x00000200775C0000-0x000002007760A000-memory.dmp

    Filesize

    296KB