44caliber | 40f450c93ce882fc29eabef25e8c13a7c3c8243de54c34d6a3bbc75aae69977b

General

Target

e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe
Size

5.7MB
MD5

e56e1ee0af12a066ee5004ea327c53ee
SHA1

50aaf0098ec7ae18a964711ee3ecc4b20da208da
SHA256

40f450c93ce882fc29eabef25e8c13a7c3c8243de54c34d6a3bbc75aae69977b
SHA512

92a03ba03ea3ae0903fd3e314bc6fa7c0d148a4849ac2f33792dfe9053068f21059fef9f37983a8adc31626eaf2a9e0d2d8fc8c52a885aed6b615c4a56f38f1f
SSDEEP

98304:g6gfOH6jJmAyj1GT1umqYsBR8p3t7PQNsPRZhXk1u:GjJmNjcT1y9Ep3RPksZZhXR

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/867877948820029491/gtNPChnQebtHAxgaee1xYkhdf00jW3BJbkQZcVt_UHg2vTCcm1V7aZkXRIEEl3lxpWMG

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/memory/2692-26-0x00000000079D0000-0x0000000007DA8000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

pid	Process
2692	RCC.exe
2620	GameWerCheatRust.exe

Loads dropped DLL 5 IoCs

pid	Process
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2620	GameWerCheatRust.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2620	WerFault.exe	29

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	RCC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	RCC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2620	GameWerCheatRust.exe
2620	GameWerCheatRust.exe
2620	GameWerCheatRust.exe
2620	GameWerCheatRust.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	GameWerCheatRust.exe
Token: SeDebugPrivilege	2692	RCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2620	GameWerCheatRust.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2692	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	28
PID 548 wrote to memory of 2692	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	28
PID 548 wrote to memory of 2692	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	28
PID 548 wrote to memory of 2692	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	28
PID 548 wrote to memory of 2620	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	29
PID 548 wrote to memory of 2620	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	29
PID 548 wrote to memory of 2620	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	29
PID 548 wrote to memory of 2620	548	e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe	29
PID 2620 wrote to memory of 2540	2620	GameWerCheatRust.exe	30
PID 2620 wrote to memory of 2540	2620	GameWerCheatRust.exe	30
PID 2620 wrote to memory of 2540	2620	GameWerCheatRust.exe	30
PID 2620 wrote to memory of 2540	2620	GameWerCheatRust.exe	30

C:\Users\Admin\AppData\Local\Temp\e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e56e1ee0af12a066ee5004ea327c53ee_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\RCC.exe
  "C:\Users\Admin\AppData\Local\Temp\RCC.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\GameWerCheatRust.exe
  "C:\Users\Admin\AppData\Local\Temp\GameWerCheatRust.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 884
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GameWerCheatRust.exe

Filesize
1.2MB

MD5
7e088b115fa4207cfb39fb5c0af1efd3

SHA1
9bd0463048abb19af56da6699599cc61483dc851

SHA256
00ba9963874ec7834f3c205647e5b5336efc36d68c627904350b92a819bc3bc0

SHA512
45b0e5578ef3527a518600d5562af430964d00ec26ca84be4c77c5af70d4ca95f30cf0f29fedfa7a890108630e602ce7cef12ee303a677a96573e47f5f6a563f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCC.exe

Filesize
8.3MB

MD5
1ad0ac8058f84302e0036ecc13dd02cf

SHA1
83c49e29c546b0118b4670885f46c8371d924c79

SHA256
22df618cf1dbd9505bd089330db2c22553038e1ece351827c54866c278002fde

SHA512
de507f371424518057cfa9983f08186e17bbb963307e5281d99524540902be618f939874da25192aac797ae9c0825ed07b17ca4cf75246b3ff017943b7c0ca84

Download Submit
memory/548-18-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/548-1-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/548-2-0x0000000000AB0000-0x0000000000B30000-memory.dmp

Filesize
512KB

Download
memory/548-0-0x00000000012C0000-0x0000000001872000-memory.dmp

Filesize
5.7MB

Download
memory/2620-21-0x00000000011B0000-0x0000000001568000-memory.dmp

Filesize
3.7MB

Download
memory/2620-34-0x0000000003140000-0x0000000003180000-memory.dmp

Filesize
256KB

Download
memory/2620-95-0x0000000003140000-0x0000000003180000-memory.dmp

Filesize
256KB

Download
memory/2620-22-0x00000000011B0000-0x0000000001568000-memory.dmp

Filesize
3.7MB

Download
memory/2620-83-0x00000000011B0000-0x0000000001568000-memory.dmp

Filesize
3.7MB

Download
memory/2620-24-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2620-25-0x00000000011B0000-0x0000000001568000-memory.dmp

Filesize
3.7MB

Download
memory/2620-81-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-67-0x0000000010580000-0x000000001063C000-memory.dmp

Filesize
752KB

Download
memory/2692-26-0x00000000079D0000-0x0000000007DA8000-memory.dmp

Filesize
3.8MB

Download
memory/2692-35-0x0000000005540000-0x0000000005580000-memory.dmp

Filesize
256KB

Download
memory/2692-10-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/2692-62-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/2692-63-0x0000000005540000-0x0000000005580000-memory.dmp

Filesize
256KB

Download
memory/2692-64-0x0000000005540000-0x0000000005580000-memory.dmp

Filesize
256KB

Download
memory/2692-19-0x0000000000400000-0x0000000000B6C000-memory.dmp

Filesize
7.4MB

Download
memory/2692-69-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-70-0x000000000C380000-0x000000000C386000-memory.dmp

Filesize
24KB

Download
memory/2692-71-0x000000000C3B0000-0x000000000C3B6000-memory.dmp

Filesize
24KB

Download
memory/2692-30-0x0000000005250000-0x00000000052A8000-memory.dmp

Filesize
352KB

Download
memory/2692-23-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-80-0x000000003B400000-0x000000003B43A000-memory.dmp

Filesize
232KB

Download
memory/2692-85-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2692-86-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2692-87-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2692-88-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2692-89-0x000000003B400000-0x000000003B43A000-memory.dmp

Filesize
232KB

Download
memory/2692-92-0x000000003B400000-0x000000003B43A000-memory.dmp

Filesize
232KB

Download
memory/2692-93-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-94-0x0000000005540000-0x0000000005580000-memory.dmp

Filesize
256KB

Download
memory/2692-11-0x0000000077070000-0x0000000077071000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing