44caliber | MentalRun[.]exe | Triage

Sharing

General

Target

MentalRun.exe
Size

274KB
MD5

18430d2473925ac89be6519d60022979
SHA1

a48a0badf5ab80de630fc0afaa79fc69a5bc18bb
SHA256

ab49f788d53435b9657f8f1e2dd58de104d52ffa9fb97898aed8f44e7354efbc
SHA512

6390bcd592ea313535a474bba33d4523a1e773921337d47cbb020cbbe61c2f35ff386de2b12f2eb1035624748421febd41df210480dc10d63927608ebf333385

Score

10^/10

discordurls 44caliber

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/951565322840862730/4aE4j6x4YXP3eBMbzUkURTY1g4UU99pU7a5DSU5qjg8GlmmffMOrYrR7kIL2_UkoKXuM

Signatures

44caliber family
44caliber

Detected executables Discord URL observed in first stage droppers 1 IoCs

DISCORD URLS.

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Files

MentalRun.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ