44caliber | 0c13135a923b9a25b31805451b8309e4dfe09b6a54913761e1a901850aaa0ed3 | Triage

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11-07-2022 12:30

Sharing

Report Analysis Logs

General

Target

1404-64-0x0000000000400000-0x00000000007D5000-memory.exe
Size

3.8MB
MD5

5de52745b2dc2ea11f4292d50c139f9a
SHA1

710b1ffc8541283ba80f5a14d0934e933ee52a4d
SHA256

0c13135a923b9a25b31805451b8309e4dfe09b6a54913761e1a901850aaa0ed3
SHA512

f93a72bf64348a62d678650ebb744bb337c62d91e235cfb22b1bbd73242d93d6b160ccc12c6032e7e6a03ec04ff3434462344f45967e9126c401bfb32784dd01

Score

10^/10

44caliber njrat stealer trojan

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1856 WerFault.exe 1404-64-0x0000000000400000-0x00000000007D5000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1404-64-0x0000000000400000-0x00000000007D5000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1404-64-0x0000000000400000-0x00000000007D5000-memory.exe"
1⤵
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 152
2⤵
- Program crash
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1856 -ip 1856
1⤵
PID:4088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-130-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download