44caliber | 99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082

Resubmissions

01-07-2024 12:05

240701-n9bt2s1akf 10

01-07-2024 11:59

240701-n5w97atdqr 10

Analysis

max time kernel
196s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 12:05

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

fix.exe
Size

35KB
MD5

83bbe29b99a54bad48074efb72ce1fcc
SHA1

421deeba13130a8eebacc8c7f48f28e6fe8485f2
SHA256

99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082
SHA512

67fe2ac907c297cd3c4d1af7f80257b468bc4e73cab428568ea1238d41cd8c43262765a0b0d43b2accb003901a66e9e7ec162fefda2fd89040697e1e168ac27f
SSDEEP

768:ChiLce92aOrsQiUy5FyS9ZL6LOjhibold:ChkceWsQi5FT9ZL6LOjGo7

Score

10^/10

44caliber xworm execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

20.ip.gl.ply.gg:53765

Mutex

JCfj6Aifpywc6Ul9

Attributes

Install_directory
%AppData%
install_file
svchost.exe

aes.plain

Extracted

Family

44caliber

https://discordapp.com/api/webhooks/1257280785476489217/L0UpV_ifGB55FAhZrd11A9RdK3XS9SxV4y_plmFbDZcUnmaJOTP9fgCIl4fpiKvDuv1o

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral4/memory/1972-1-0x0000000000A60000-0x0000000000A70000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4480 powershell.exe
604 powershell.exe
3760 powershell.exe
440 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

fix.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation fix.exe
Executes dropped EXE 3 IoCs

Processes:

teukmb.exeapgdqz.exeguknck.exe

pid process

4920 teukmb.exe
3588 apgdqz.exe
2600 guknck.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

resource	yara_rule
behavioral4/memory/1972-1-0x0000000000A60000-0x0000000000A70000-memory.dmp	family_xworm

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	fix.exe

pid	process
4920	teukmb.exe
3588	apgdqz.exe
2600	guknck.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fix.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	fix.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

53 freegeoip.app
54 freegeoip.app
57 freegeoip.app
58 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
53	freegeoip.app
54	freegeoip.app
57	freegeoip.app
58	freegeoip.app

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "95"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeteukmb.exeapgdqz.exeguknck.exe

pid	process
4480	powershell.exe
4480	powershell.exe
604	powershell.exe
604	powershell.exe
3760	powershell.exe
3760	powershell.exe
440	powershell.exe
440	powershell.exe
4920	teukmb.exe
4920	teukmb.exe
4920	teukmb.exe
3588	apgdqz.exe
3588	apgdqz.exe
3588	apgdqz.exe
2600	guknck.exe
2600	guknck.exe
2600	guknck.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

fix.exepowershell.exepowershell.exepowershell.exepowershell.exeteukmb.exeapgdqz.exeguknck.exeshutdown.exe

description	pid	process
Token: SeDebugPrivilege	1972	fix.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	1972	fix.exe
Token: SeDebugPrivilege	4920	teukmb.exe
Token: SeDebugPrivilege	3588	apgdqz.exe
Token: SeDebugPrivilege	2600	guknck.exe
Token: SeShutdownPrivilege	1232	shutdown.exe
Token: SeRemoteShutdownPrivilege	1232	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

2112 LogonUI.exe

pid	process
2112	LogonUI.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

fix.exe

description	pid	process	target process
PID 1972 wrote to memory of 4480	1972	fix.exe	powershell.exe
PID 1972 wrote to memory of 4480	1972	fix.exe	powershell.exe
PID 1972 wrote to memory of 604	1972	fix.exe	powershell.exe
PID 1972 wrote to memory of 604	1972	fix.exe	powershell.exe
PID 1972 wrote to memory of 3760	1972	fix.exe	powershell.exe
PID 1972 wrote to memory of 3760	1972	fix.exe	powershell.exe
PID 1972 wrote to memory of 440	1972	fix.exe	powershell.exe
PID 1972 wrote to memory of 440	1972	fix.exe	powershell.exe
PID 1972 wrote to memory of 4920	1972	fix.exe	teukmb.exe
PID 1972 wrote to memory of 4920	1972	fix.exe	teukmb.exe
PID 1972 wrote to memory of 3588	1972	fix.exe	apgdqz.exe
PID 1972 wrote to memory of 3588	1972	fix.exe	apgdqz.exe
PID 1972 wrote to memory of 2600	1972	fix.exe	guknck.exe
PID 1972 wrote to memory of 2600	1972	fix.exe	guknck.exe
PID 1972 wrote to memory of 1232	1972	fix.exe	shutdown.exe
PID 1972 wrote to memory of 1232	1972	fix.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\fix.exe
"C:\Users\Admin\AppData\Local\Temp\fix.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fix.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fix.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Users\Admin\AppData\Local\Temp\teukmb.exe
"C:\Users\Admin\AppData\Local\Temp\teukmb.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Users\Admin\AppData\Local\Temp\apgdqz.exe
"C:\Users\Admin\AppData\Local\Temp\apgdqz.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Users\Admin\AppData\Local\Temp\guknck.exe
"C:\Users\Admin\AppData\Local\Temp\guknck.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\SYSTEM32\shutdown.exe
shutdown.exe /f /s /t 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3961855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
eb1ad317bd25b55b2bbdce8a28a74a94

SHA1
98a3978be4d10d62e7411946474579ee5bdc5ea6

SHA256
9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

SHA512
d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ba169f4dcbbf147fe78ef0061a95e83b

SHA1
92a571a6eef49fff666e0f62a3545bcd1cdcda67

SHA256
5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

SHA512
8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rtjttfhp.f5v.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\teukmb.exe
Filesize
303KB

MD5
89069c3d83c29f44929e8f73e5672643

SHA1
8d2808c427dc3a039de3ab0902c7454d46d2a4a4

SHA256
69c4efe455f5c826e1c9df05518546a282efd01513c5ac811a9399f74e494216

SHA512
c81dd0189efc4e92813f4e9f224c59a246e8bec8b19185cc0a43da909a5acead5378b6b126bece793cd3d17fc25cf2f8a29d2a74169557317cf57252716beb08

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3A31.tmp.dat
Filesize
100KB

MD5
78855c87b9d2682c8141f1afe227dd1d

SHA1
8b0bf8584c49cf70bebb1b289f765532eb0cb127

SHA256
c9217d14f586d9e694446bcf76f67442b2440af2a3bce5fa593194bcd314f4e0

SHA512
cb54bb1683f31ef4f5f4766745909a48dbf61cbbff409a3a596d8b71d65a9f879c47eb479c67e58dd3a05a0049d5bdbd4215242490a9f552ad131d5ef95975b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3A54.tmp.dat
Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp56F1.tmp.dat
Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp56F5.tmp.dat
Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp56F6.tmp.tmpdb
Filesize
5.0MB

MD5
8893dfa5ec4242a611d84e73ae9b1285

SHA1
db5c47e24f359fe7fbfa83cf2547ee7d4a78cb32

SHA256
631b7211917f7d40aff81bbe5cbb383c1570198fec51d29cabb827f006bd94ff

SHA512
ad1a66132aae4066649dc20e6ba046ee1dda3f2251052783ff39e0f7bee02c4c5d606a727c68a2ba58d309454e8ac91f96317d08b94fc4072891a3d979d415ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5707.tmp.dat
Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5746.tmp.tmpdb
Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
memory/1972-1-0x0000000000A60000-0x0000000000A70000-memory.dmp

Filesize
64KB

Download
memory/1972-186-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Filesize
10.8MB

Download
memory/1972-54-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Filesize
10.8MB

Download
memory/1972-55-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Filesize
10.8MB

Download
memory/1972-56-0x0000000001200000-0x000000000120C000-memory.dmp

Filesize
48KB

Download
memory/1972-0-0x00007FF8D81B3000-0x00007FF8D81B5000-memory.dmp

Filesize
8KB

Download
memory/4480-12-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Filesize
10.8MB

Download
memory/4480-2-0x0000023CC4D00000-0x0000023CC4D22000-memory.dmp

Filesize
136KB

Download
memory/4480-18-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Filesize
10.8MB

Download
memory/4480-13-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Filesize
10.8MB

Download
memory/4480-14-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Filesize
10.8MB

Download
memory/4480-15-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Filesize
10.8MB

Download
memory/4920-68-0x00000236DA860000-0x00000236DA8B2000-memory.dmp

Filesize
328KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads