44caliber | 17aa956666874517c1b01a18a15df3f29d9f06a09480b7983c9a642330baa280 | Triage

Analysis

max time kernel
90s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11-07-2022 12:33

Sharing

Report Analysis Logs

General

Target

1400-55-0x0000000000400000-0x00000000007D5000-memory.exe
Size

3.8MB
MD5

08aac4da6cbb0711af779064c2785b51
SHA1

61b37bf8ea4852fe907110f6e37aaa8e39b40cc0
SHA256

17aa956666874517c1b01a18a15df3f29d9f06a09480b7983c9a642330baa280
SHA512

69d320da539ac09e5bab62aa6f07009b2ca59f371ef24947cc1542b173aa7cb5697e26de4536ae637e84a35c47c1ce1f776935b38a94e43073787afc2404dc52

Score

10^/10

44caliber njrat stealer trojan

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3040 4588 WerFault.exe 1400-55-0x0000000000400000-0x00000000007D5000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1400-55-0x0000000000400000-0x00000000007D5000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1400-55-0x0000000000400000-0x00000000007D5000-memory.exe"
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 216
2⤵
- Program crash
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4588 -ip 4588
1⤵
PID:3476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4588-130-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download