44caliber | 40f450c93ce882fc29eabef25e8c13a7c3c8243de54c34d6a3bbc75aae69977b

General

Target

e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe
Size

5.7MB
MD5

e56e1ee0af12a066ee5004ea327c53ee
SHA1

50aaf0098ec7ae18a964711ee3ecc4b20da208da
SHA256

40f450c93ce882fc29eabef25e8c13a7c3c8243de54c34d6a3bbc75aae69977b
SHA512

92a03ba03ea3ae0903fd3e314bc6fa7c0d148a4849ac2f33792dfe9053068f21059fef9f37983a8adc31626eaf2a9e0d2d8fc8c52a885aed6b615c4a56f38f1f
SSDEEP

98304:g6gfOH6jJmAyj1GT1umqYsBR8p3t7PQNsPRZhXk1u:GjJmNjcT1y9Ep3RPksZZhXR

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/867877948820029491/gtNPChnQebtHAxgaee1xYkhdf00jW3BJbkQZcVt_UHg2vTCcm1V7aZkXRIEEl3lxpWMG

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2692-26-0x00000000079D0000-0x0000000007DA8000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

RCC.exeGameWerCheatRust.exe

pid process

2692 RCC.exe
2620 GameWerCheatRust.exe
Loads dropped DLL 5 IoCs

Processes:

WerFault.exe

pid process

2540 WerFault.exe
2540 WerFault.exe
2540 WerFault.exe
2540 WerFault.exe
2540 WerFault.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

GameWerCheatRust.exe

pid process

2620 GameWerCheatRust.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2540 2620 WerFault.exe GameWerCheatRust.exe

pid	process
2692	RCC.exe
2620	GameWerCheatRust.exe

pid	process
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe

pid	process
2620	GameWerCheatRust.exe

pid	pid_target	process	target process
2540	2620	WerFault.exe	GameWerCheatRust.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RCC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	RCC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	RCC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

GameWerCheatRust.exe

pid process

2620 GameWerCheatRust.exe
2620 GameWerCheatRust.exe
2620 GameWerCheatRust.exe
2620 GameWerCheatRust.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

GameWerCheatRust.exeRCC.exe

description pid process

Token: SeDebugPrivilege 2620 GameWerCheatRust.exe
Token: SeDebugPrivilege 2692 RCC.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

GameWerCheatRust.exe

pid process

2620 GameWerCheatRust.exe

pid	process
2620	GameWerCheatRust.exe
2620	GameWerCheatRust.exe
2620	GameWerCheatRust.exe
2620	GameWerCheatRust.exe

description	pid	process
Token: SeDebugPrivilege	2620	GameWerCheatRust.exe
Token: SeDebugPrivilege	2692	RCC.exe

pid	process
2620	GameWerCheatRust.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exeGameWerCheatRust.exe

description	pid	process	target process
PID 548 wrote to memory of 2692	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	RCC.exe
PID 548 wrote to memory of 2692	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	RCC.exe
PID 548 wrote to memory of 2692	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	RCC.exe
PID 548 wrote to memory of 2692	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	RCC.exe
PID 548 wrote to memory of 2620	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	GameWerCheatRust.exe
PID 548 wrote to memory of 2620	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	GameWerCheatRust.exe
PID 548 wrote to memory of 2620	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	GameWerCheatRust.exe
PID 548 wrote to memory of 2620	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	GameWerCheatRust.exe
PID 2620 wrote to memory of 2540	2620	GameWerCheatRust.exe	WerFault.exe
PID 2620 wrote to memory of 2540	2620	GameWerCheatRust.exe	WerFault.exe
PID 2620 wrote to memory of 2540	2620	GameWerCheatRust.exe	WerFault.exe
PID 2620 wrote to memory of 2540	2620	GameWerCheatRust.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Users\Admin\AppData\Local\Temp\RCC.exe
"C:\Users\Admin\AppData\Local\Temp\RCC.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Users\Admin\AppData\Local\Temp\GameWerCheatRust.exe
"C:\Users\Admin\AppData\Local\Temp\GameWerCheatRust.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 884
3⤵
- Loads dropped DLL
- Program crash
PID:2540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1

T1553

Install Root Certificate

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GameWerCheatRust.exe
Filesize
1.2MB

MD5
7e088b115fa4207cfb39fb5c0af1efd3

SHA1
9bd0463048abb19af56da6699599cc61483dc851

SHA256
00ba9963874ec7834f3c205647e5b5336efc36d68c627904350b92a819bc3bc0

SHA512
45b0e5578ef3527a518600d5562af430964d00ec26ca84be4c77c5af70d4ca95f30cf0f29fedfa7a890108630e602ce7cef12ee303a677a96573e47f5f6a563f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCC.exe
Filesize
8.3MB

MD5
1ad0ac8058f84302e0036ecc13dd02cf

SHA1
83c49e29c546b0118b4670885f46c8371d924c79

SHA256
22df618cf1dbd9505bd089330db2c22553038e1ece351827c54866c278002fde

SHA512
de507f371424518057cfa9983f08186e17bbb963307e5281d99524540902be618f939874da25192aac797ae9c0825ed07b17ca4cf75246b3ff017943b7c0ca84

Download Submit
memory/548-18-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/548-1-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/548-2-0x0000000000AB0000-0x0000000000B30000-memory.dmp

Filesize
512KB

Download
memory/548-0-0x00000000012C0000-0x0000000001872000-memory.dmp

Filesize
5.7MB

Download
memory/2620-21-0x00000000011B0000-0x0000000001568000-memory.dmp

Filesize
3.7MB

Download
memory/2620-34-0x0000000003140000-0x0000000003180000-memory.dmp

Filesize
256KB

Download
memory/2620-95-0x0000000003140000-0x0000000003180000-memory.dmp

Filesize
256KB

Download
memory/2620-22-0x00000000011B0000-0x0000000001568000-memory.dmp

Filesize
3.7MB

Download
memory/2620-83-0x00000000011B0000-0x0000000001568000-memory.dmp

Filesize
3.7MB

Download
memory/2620-24-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2620-25-0x00000000011B0000-0x0000000001568000-memory.dmp

Filesize
3.7MB

Download
memory/2620-81-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-67-0x0000000010580000-0x000000001063C000-memory.dmp

Filesize
752KB

Download
memory/2692-26-0x00000000079D0000-0x0000000007DA8000-memory.dmp

Filesize
3.8MB

Download
memory/2692-35-0x0000000005540000-0x0000000005580000-memory.dmp

Filesize
256KB

Download
memory/2692-10-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/2692-62-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/2692-63-0x0000000005540000-0x0000000005580000-memory.dmp

Filesize
256KB

Download
memory/2692-64-0x0000000005540000-0x0000000005580000-memory.dmp

Filesize
256KB

Download
memory/2692-19-0x0000000000400000-0x0000000000B6C000-memory.dmp

Filesize
7.4MB

Download
memory/2692-69-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-70-0x000000000C380000-0x000000000C386000-memory.dmp

Filesize
24KB

Download
memory/2692-71-0x000000000C3B0000-0x000000000C3B6000-memory.dmp

Filesize
24KB

Download
memory/2692-30-0x0000000005250000-0x00000000052A8000-memory.dmp

Filesize
352KB

Download
memory/2692-23-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-80-0x000000003B400000-0x000000003B43A000-memory.dmp

Filesize
232KB

Download
memory/2692-85-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2692-86-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2692-87-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2692-88-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2692-89-0x000000003B400000-0x000000003B43A000-memory.dmp

Filesize
232KB

Download
memory/2692-92-0x000000003B400000-0x000000003B43A000-memory.dmp

Filesize
232KB

Download
memory/2692-93-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-94-0x0000000005540000-0x0000000005580000-memory.dmp

Filesize
256KB

Download
memory/2692-11-0x0000000077070000-0x0000000077071000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads