44caliber | 3faedcc22bc895edc7233f536334f3279ba5a37981a785161aeab0475ef663d9

General

Target

eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe
Size

12.9MB
MD5

eb045f6f1699993a09871b1b184c78f1
SHA1

7466f95d1bbcb5aec42de0cd214fc0604fe2e01e
SHA256

3faedcc22bc895edc7233f536334f3279ba5a37981a785161aeab0475ef663d9
SHA512

223bf649bfd7519b9be57d26c6b8dae1153b95eae2afaa479c967e9a23bc94d31444673ce1fde4503c8f7f68761298ef129ef301e8b49984d9df3a3185194ca1
SSDEEP

393216:hJBaDSaO5n2q/aRvO7HGnBeoCurvpkiO8k9f:SIARW7qB1kibkJ

Score

10^/10

44caliber spyware stealer vmprotect

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/900043826423529532/EWbFb5juNPSPjtMYmjttPuTpP5_GU9kfOyaD_5kSpHjK12-mwDRIjTIcxPRYwSjJ0QE8

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	ExLoader_Installer.exe

Executes dropped EXE 2 IoCs

pid	Process
1820	ExLoader_Installer.exe
4796	Insidious.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1512-0-0x0000000000400000-0x0000000001C16000-memory.dmp	vmprotect
behavioral2/memory/1512-3-0x0000000000400000-0x0000000001C16000-memory.dmp	vmprotect
behavioral2/memory/1512-13-0x0000000000400000-0x0000000001C16000-memory.dmp	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	freegeoip.app
14	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1512	eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1512	eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe
1512	eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe
4796	Insidious.exe
4796	Insidious.exe
4796	Insidious.exe
4796	Insidious.exe
4796	Insidious.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	Insidious.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1820	1512	eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe	96
PID 1512 wrote to memory of 1820	1512	eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe	96
PID 1512 wrote to memory of 1820	1512	eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe	96
PID 1820 wrote to memory of 4796	1820	ExLoader_Installer.exe	97
PID 1820 wrote to memory of 4796	1820	ExLoader_Installer.exe	97

C:\Users\Admin\AppData\Local\Temp\eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb045f6f1699993a09871b1b184c78f1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Users\Admin\AppData\Local\Temp\Insidious.exe
    "C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe

Filesize
8.4MB

MD5
a7460df7a66f891e21f4ba5739f495fc

SHA1
cf0211a12e8e930d21d28c467b1724aea5f26fbd

SHA256
866414d88f9d620b0258c3cbf389d505b4e5a0a189bda76d3d08acd108cf7809

SHA512
9da71a404ad145982a24dd1160d7132b1a842892ade437106be377ecad4df7621208d9685ba0797efa638afcacbb31158d5497b3263b0394c52bb7670408d7f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious.exe

Filesize
274KB

MD5
1f84bfa9402647277bcff75f9ba54831

SHA1
03711684abf8667d385f8a1d3e2d7a0e5e4bdedc

SHA256
a7c0cab5dafe40fcffc114b6baac7ab9978bf5885a035d01d6f326cf095a87df

SHA512
c6584b81c55c221c3662b0c9a9ee54cfcd63ad935e4eb659aaa206ac47d584d9e51910934ab153e6bf9963134dc550fa6613cf8b4dde1d9c1bc6de0796687eef

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
1KB

MD5
e75e8e984dfb461825dcbb4f9de6345c

SHA1
bcbdc913c0f59d8fa3d833bf860a5fb4b8adce01

SHA256
4d5bb4f57e96afe85c377b3db6b85f1823c466f336ca31cf5346571e47ae7e76

SHA512
5c41079f76897d64ea62881b03b538dbbbaacda40baa24beee1f8469ac684d0ddf1b54a5dfb0eb50e6efc45caf256e7c2ee63f8f9fe983b7c82ce910fbecba19

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
297B

MD5
bc78995005c5ab99ece683856c2efa6c

SHA1
25c9c066e37a961216f268b21809902d9325d212

SHA256
5096d13b8408fccb53e2e809e702ec114b42f4bb293d0d261131a931c5fb40b5

SHA512
04d5cc742b21ea32598dc0cea18aae867df57c24bfe7666458c4e956645065ee6ba0f9f33a662b50a73c88b01ad81a390e9ee8de524991e41c3e5338ad45ff7b

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt

Filesize
926B

MD5
7866df345bfdf92519b2d319feac5e1a

SHA1
0385dfbd426d41f506a7ac6a171c415c6300ec65

SHA256
43dcdf1be7158905246ccc209e4349c49c04f3fa65dfab5198fcc792d18f5bfd

SHA512
1e948c1ecd0b497e63f1d91ce89541a46dadee508ee75cf0451983099d8d583ea73f766c840200180bbe776abb9eb02a39ff74317b6d57835fe9b078963cf03a

Download Submit
memory/1512-3-0x0000000000400000-0x0000000001C16000-memory.dmp

Filesize
24.1MB

Download
memory/1512-13-0x0000000000400000-0x0000000001C16000-memory.dmp

Filesize
24.1MB

Download
memory/1512-0-0x0000000000400000-0x0000000001C16000-memory.dmp

Filesize
24.1MB

Download
memory/1512-2-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/1512-1-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1820-24-0x0000000000400000-0x0000000000C6E000-memory.dmp

Filesize
8.4MB

Download
memory/4796-25-0x0000000000D40000-0x0000000000D8A000-memory.dmp

Filesize
296KB

Download
memory/4796-26-0x00007FFB6DD90000-0x00007FFB6E851000-memory.dmp

Filesize
10.8MB

Download
memory/4796-27-0x000000001BA90000-0x000000001BAA0000-memory.dmp

Filesize
64KB

Download
memory/4796-156-0x00007FFB6DD90000-0x00007FFB6E851000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads