Play interactive tour

Edit tour

Windows Analysis Report E9NhUneknw

Overview

General Information

Sample Name:	E9NhUneknw (renamed file extension from none to exe)
Analysis ID:	466786
MD5:	f3d648c4f3a0f9cfbead90e546efe8f6
SHA1:	cba4d6e13b5f1e766914ef65ff50c19bb295c17f
SHA256:	cd80318bc4c724934435231e72cbf7cbf5942df8b36e480603237e2ed08d4a93
Tags:	32exe
Infos:
Most interesting Screenshot:

Detection

44Caliber Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected 44Caliber Stealer

Antivirus / Scanner detection for submitted sample

Tries to steal Crypto Currency Wallets

Contains functionality to capture screen (.Net source)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Enables debug privileges

Queries information about the installed CPU (vendor, model number etc)

Sample file is different than original file name gathered from version info

Binary contains a suspicious time stamp

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

E9NhUneknw.exe (PID: 6904 cmdline: 'C:\Users\user\Desktop\E9NhUneknw.exe' MD5: F3D648C4F3A0F9CFBEAD90E546EFE8F6)

cleanup

Malware Configuration

Threatname: 44Caliber Stealer

{"Discord Webhook": "https://discord.com/api/webhooks/877106556905328661/OyLkuIbHolsGkE_Gsdhp8C-pOzTVH86ebFWF0y5BTWS_pIz1kXoCYdJjwftfW7KLWuy0\u0001logger"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
E9NhUneknw.exe	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
E9NhUneknw.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.685062337.000000000292E000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: E9NhUneknw.exe PID: 6904	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.E9NhUneknw.exe.4f0000.0.unpack	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
0.0.E9NhUneknw.exe.4f0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.E9NhUneknw.exe.4f0000.0.unpack	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
0.2.E9NhUneknw.exe.4f0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.E9NhUneknw.exe.4f0000.0.unpack

Malware Configuration Extractor: 44Caliber Stealer {"Discord Webhook": "https://discord.com/api/webhooks/877106556905328661/OyLkuIbHolsGkE_Gsdhp8C-pOzTVH86ebFWF0y5BTWS_pIz1kXoCYdJjwftfW7KLWuy0\u0001logger"}

Multi AV Scanner detection for submitted file

Show sources

Source: E9NhUneknw.exe

Virustotal: Detection: 67%

Perma Link

Antivirus / Scanner detection for submitted sample

Show sources

Source: E9NhUneknw.exe

Avira: detected

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD557A CryptUnprotectData,		0_2_00007FFA35FD557A
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FDC4B9 CryptUnprotectData,		0_2_00007FFA35FDC4B9

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.4:49733 version: TLS 1.0

Source: E9NhUneknw.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb" source: E9NhUneknw.exe, 00000000.00000003.673158824.0000000000A24000.00000004.00000001.sdmp
Source:	Binary string: .PDBimeS source: E9NhUneknw.exe, 00000000.00000002.683565920.000000000099B000.00000004.00000020.sdmp
Source:	Binary string: E:\44CALIBER-main\44CALIBER-main\44CALIBER\obj\Release\Insidious.pdb source: E9NhUneknw.exe

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: Joe Sandbox View

IP Address: 172.67.188.154 172.67.188.154

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.4:49733 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733

Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp

String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://freegeoip.app
Source: E9NhUneknw.exe, 00000000.00000003.682808349.000000001B654000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobp/1.0/
Source: E9NhUneknw.exe, 00000000.00000003.677573262.000000001B641000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobp/1.0/w
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: E9NhUneknw.exe, E9NhUneknw.exe, 00000000.00000002.684605624.0000000002881000.00000004.00000001.sdmp	String found in binary or memory: https://api.vimeworld.ru/user/name/
Source: E9NhUneknw.exe	String found in binary or memory: https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: E9NhUneknw.exe	String found in binary or memory: https://discord.com/api/webhooks/877106556905328661/OyLkuIbHolsGkE_Gsdhp8C-pOzTVH86ebFWF0y5BTWS_pIz1
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app
Source: E9NhUneknw.exe	String found in binary or memory: https://freegeoip.app/xml/
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.appx
Source: E9NhUneknw.exe, 00000000.00000002.686752727.0000000002AF0000.00000004.00000001.sdmp, E9NhUneknw.exe, 00000000.00000002.686761919.0000000002AF4000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: E9NhUneknw.exe	String found in binary or memory: https://steamcommunity.com/profiles/
Source: E9NhUneknw.exe	String found in binary or memory: https://steamcommunity.com/profiles/ASOFTWARE
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: freegeoip.app

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to capture screen (.Net source)

Show sources

Source: 0.0.E9NhUneknw.exe.4f0000.0.unpack, youknowcaliber/Screen.cs

.Net Code: GetScreen

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FE3042	0_2_00007FFA35FE3042
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD0E18	0_2_00007FFA35FD0E18
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FE2296	0_2_00007FFA35FE2296

Source: E9NhUneknw.exe	Binary or memory string: OriginalFilename vs E9NhUneknw.exe
Source: E9NhUneknw.exe, 00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameInsidious.exe6 vs E9NhUneknw.exe
Source: E9NhUneknw.exe, 00000000.00000002.683460236.000000000094A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs E9NhUneknw.exe
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs E9NhUneknw.exe
Source: E9NhUneknw.exe	Binary or memory string: OriginalFilenameInsidious.exe6 vs E9NhUneknw.exe

Source: E9NhUneknw.exe

Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\E9NhUneknw.exe

File read: C:\Users\user\Desktop\E9NhUneknw.exe

Source: E9NhUneknw.exe, youknowcaliber/Help.cs	Suspicious URL: 'https://api.vimeworld.ru/user/name/'
Source: 0.2.E9NhUneknw.exe.4f0000.0.unpack, youknowcaliber/Help.cs	Suspicious URL: 'https://api.vimeworld.ru/user/name/'
Source: 0.0.E9NhUneknw.exe.4f0000.0.unpack, youknowcaliber/Help.cs	Suspicious URL: 'https://api.vimeworld.ru/user/name/'

Source: C:\Users\user\Desktop\E9NhUneknw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\E9NhUneknw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\E9NhUneknw.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD5829 push eax; retf	0_2_00007FFA35FD59DD
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD550A push eax; retf	0_2_00007FFA35FD5563
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD5572 push eax; retf	0_2_00007FFA35FD5573
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD55A0 push eax; retf	0_2_00007FFA35FD5563

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe TID: 6924	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe TID: 4732	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: E9NhUneknw.exe, 00000000.00000002.689373636.000000001D251000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: E9NhUneknw.exe, 00000000.00000002.689373636.000000001D251000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareM4PWCN5RWin32_VideoController_VG81BS9VideoController120060621000000.000000-00035525620display.infMSBDAT721FNDFPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsZERY_XE5rogr
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: E9NhUneknw.exe, 00000000.00000002.689054710.000000001B840000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQQ
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: Yara match	File source: E9NhUneknw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.E9NhUneknw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E9NhUneknw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp, type: MEMORY

Source: E9NhUneknw.exe	String found in binary or memory: ElectrumDir
Source: E9NhUneknw.exe, 00000000.00000002.685062337.000000000292E000.00000004.00000001.sdmp	String found in binary or memory: 1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: E9NhUneknw.exe	String found in binary or memory: JaxxDir
Source: E9NhUneknw.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: E9NhUneknw.exe	String found in binary or memory: \Ethereum\keystore
Source: E9NhUneknw.exe	String found in binary or memory: ExodusDir
Source: E9NhUneknw.exe	String found in binary or memory: EthereumDir
Source: E9NhUneknw.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: E9NhUneknw.exe	String found in binary or memory: \Ethereum\keystore

Source: C:\Users\user\Desktop\E9NhUneknw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation121	Path Interception	Path Interception	Masquerading1	OS Credential Dumping1	Query Registry1	Remote Services	Screen Capture1	Exfiltration Over Other Network Medium	Encrypted Channel22	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Security Software Discovery121	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion141	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Local System3	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Virtualization/Sandbox Evasion141	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery33	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report E9NhUneknw

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: 44Caliber Stealer

Yara Overview

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph