44caliber | 14a1264513387d0de5b2ff845e9f87281c541454f3602195bd4722071c9cd993

General

Target

Insidious.exe
Size

274KB
MD5

7a083b21373fd2434499809259fde79b
SHA1

76a4435b5d6962ac5075ab5f6da961c3ec8b69c9
SHA256

14a1264513387d0de5b2ff845e9f87281c541454f3602195bd4722071c9cd993
SHA512

bc1ccfa81f536f05870030b681a090b867bdb2ac557bd136590566a7c1b0487f9360d59d765dddc017ed0a1b611df8bdc08ad3e50c167a968b3a7168f38056b0
SSDEEP

6144:Sf+BLtABPDtFxzerToNZrOGy4xlc41V6GIeyXsRA1D0F+t:AFfNZrOR4EY69eyXd1DXt

Score

10^/10

44caliber discovery spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/882489630065319956/VC0YwvBy87naF4ORGT57s3TAJyA-YLmF9HH8KTWMAMdx5J5HhF5egYZOK_c3-xXSTcUg

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
44Caliber family
44caliber
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	solitaire.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	ehshell.exe
File opened for modification	C:\Users\Public\desktop.ini	ehshell.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	ehshell.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	freegeoip.app
5	freegeoip.app

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	ehshell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	ehshell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ehshell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	ehshell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ehshell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats	solitaire.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}\LastPlayed = "0"	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	ehshell.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ehshell.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft	solitaire.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	ehshell.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	ehshell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	ehshell.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\microsoft\ehome\ehthumbs_vista.db:encryptable	ehshell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2224	Insidious.exe
2224	Insidious.exe
2224	Insidious.exe
2224	Insidious.exe
3020	ehshell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1932	solitaire.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	Insidious.exe
Token: SeDebugPrivilege	3020	ehshell.exe
Token: SeShutdownPrivilege	3020	ehshell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 784	3020	ehshell.exe	35
PID 3020 wrote to memory of 784	3020	ehshell.exe	35
PID 3020 wrote to memory of 784	3020	ehshell.exe	35
PID 3020 wrote to memory of 784	3020	ehshell.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Insidious.exe
"C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\EnterSave.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2228

C:\Windows\eHome\ehshell.exe
"C:\Windows\eHome\ehshell.exe" /prefetch:1003 "C:\Users\Admin\Desktop\StepExport.DVR"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /SkipFUE /RemoteOCXLaunch /SuppressDialogs
  2⤵
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:784

C:\Program Files\Microsoft Games\solitaire\solitaire.exe
"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-75-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-106-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-126-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-128-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-129-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-130-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-72-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-71-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-70-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-69-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-68-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-73-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-77-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-76-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-127-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-125-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-104-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-124-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-103-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-107-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/1932-74-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/1932-105-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/2224-0-0x000007FEF5593000-0x000007FEF5594000-memory.dmp

Filesize
4KB

Download
memory/2224-1-0x0000000000210000-0x000000000025A000-memory.dmp

Filesize
296KB

Download
memory/2224-51-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-19-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

Filesize
9.9MB

Download
memory/3020-92-0x000000001BF10000-0x000000001BFAE000-memory.dmp

Filesize
632KB

Download
memory/3020-93-0x000000001F2E0000-0x000000001F398000-memory.dmp

Filesize
736KB

Download
memory/3020-67-0x000000001E940000-0x000000001EAC4000-memory.dmp

Filesize
1.5MB

Download
memory/3020-66-0x000000001E330000-0x000000001E938000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads