44caliber | 9fa20d35011ed9990b8df980830bb843d262a305dac9e22c75780e8f76f58efe

General

Target

ed29dcde8768f1e4c759486140c338cd_JaffaCakes118.exe
Size

3.9MB
MD5

ed29dcde8768f1e4c759486140c338cd
SHA1

d721f6ca0615b83fb541fc7600c026ad0a8c1e1d
SHA256

9fa20d35011ed9990b8df980830bb843d262a305dac9e22c75780e8f76f58efe
SHA512

953675610a166f8dbb6423194aa205d75c43ae4ba312540d8ea25b9f48644f35026f62ed61b2660f9597e8f4bf8f2f0447b08b8686d2e52a1edc0326dfdd0bc1
SSDEEP

98304:JngRc3P5083Yf+hW1jfN2C0GnijlUME/w00xpw7V:met3+l9N2GQqME4jEV

Score

10^/10

44caliber spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/854662966200762408/UEPTBr2Rw2bbBl8kdAtd687oxi7BxJ7RDU99BRreTgVoN7lgDrh84_ew6GVD5oxR2dPt

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ed29dcde8768f1e4c759486140c338cd_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	sddssd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Cheat Fortnite.sfx.exe

Executes dropped EXE 3 IoCs

pid	Process
3376	sddssd.exe
4584	Cheat Fortnite.sfx.exe
3180	Cheat Fortnite.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	freegeoip.app
15	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3180	Cheat Fortnite.exe
3180	Cheat Fortnite.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Cheat Fortnite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Cheat Fortnite.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3180	Cheat Fortnite.exe
3180	Cheat Fortnite.exe
3180	Cheat Fortnite.exe
3180	Cheat Fortnite.exe
3180	Cheat Fortnite.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	Cheat Fortnite.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3180	Cheat Fortnite.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3376	4244	ed29dcde8768f1e4c759486140c338cd_JaffaCakes118.exe	92
PID 4244 wrote to memory of 3376	4244	ed29dcde8768f1e4c759486140c338cd_JaffaCakes118.exe	92
PID 4244 wrote to memory of 3376	4244	ed29dcde8768f1e4c759486140c338cd_JaffaCakes118.exe	92
PID 3376 wrote to memory of 4584	3376	sddssd.exe	94
PID 3376 wrote to memory of 4584	3376	sddssd.exe	94
PID 3376 wrote to memory of 4584	3376	sddssd.exe	94
PID 4584 wrote to memory of 3180	4584	Cheat Fortnite.sfx.exe	95
PID 4584 wrote to memory of 3180	4584	Cheat Fortnite.sfx.exe	95
PID 4584 wrote to memory of 3180	4584	Cheat Fortnite.sfx.exe	95

C:\Users\Admin\AppData\Local\Temp\ed29dcde8768f1e4c759486140c338cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed29dcde8768f1e4c759486140c338cd_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\sddssd.exe
  "C:\Users\Admin\AppData\Local\Temp\sddssd.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Cheat Fortnite.sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\Cheat Fortnite.sfx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Cheat Fortnite.exe
      "C:\Users\Admin\AppData\Local\Temp\Cheat Fortnite.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
1KB

MD5
c45a9293bd7e51d739adeee5a94d97f5

SHA1
c78e26cde6abb820070f1d87bfd23d41484b30e1

SHA256
5bf99980986a1a06c86e93966b6642de7aa6778c17c4c5575b9c48486a929526

SHA512
f8be1321af21e6543b6bfefad89cc4e94d1470b41eb8fae4e5485fb35aa80c1ad8259f257702b386628b47c503a62a644e412dc96cb1d47366de325902baa696

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Fortnite.exe

Filesize
1.2MB

MD5
e5a7c65e35484add5c45ed3e63bf5a0b

SHA1
ec940e864b767439d8c13c2d778688be84afd679

SHA256
9a123d6563f305258b607c6b140e75d67b6af5d5326430fe95382c31e6ff892a

SHA512
94a79837da3264f9094e188ab414e075bad0f0cee6e2dd27bcf86bddf13b92fa716951d3d72b55914a8de527ac2d7ff20d6ba4d3134b9c602fcb97763d46deb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat Fortnite.sfx.exe

Filesize
1.5MB

MD5
afc74fa97393a7032b18952296c72274

SHA1
a57ff2ff6b5859f9ae7ee3d8c3714f46e83e7314

SHA256
2f366b4d028cff3bd66b129429fdf983bd61a0ef09d8f671d53eee1496bea457

SHA512
f985e16ae44af9cbcda23c9d59bba9808cccb86f68fcaca84443fdd357b2f012165f8373e340c494096ba42e082ab8cd9ff3ba4150ee7f51191ced0b9da86155

Download Submit
C:\Users\Admin\AppData\Local\Temp\sddssd.exe

Filesize
3.7MB

MD5
63effee73b0c6196e789fb51707af27c

SHA1
83e01d9aa60433ece232153e61e3b887557a3010

SHA256
2ea7f8eb51924b903a1555f81bebf5523775856185a91c38a4f9ef9304e3472f

SHA512
2ab6618d3f6f51536c541fe350442865d44daca57ec2917c269384a4b4abc365a70271b5f7396920a8e07b1058c6b3458b0c2a39d0277e8e3985f1c6d58746e3

Download Submit
memory/3180-37-0x00000000059A0000-0x00000000059B0000-memory.dmp

Filesize
64KB

Download
memory/3180-36-0x0000000000110000-0x00000000004BC000-memory.dmp

Filesize
3.7MB

Download
memory/3180-38-0x0000000006190000-0x0000000006222000-memory.dmp

Filesize
584KB

Download
memory/3180-35-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download
memory/3180-68-0x0000000006CE0000-0x0000000007284000-memory.dmp

Filesize
5.6MB

Download
memory/3180-34-0x0000000000110000-0x00000000004BC000-memory.dmp

Filesize
3.7MB

Download
memory/3180-166-0x0000000006B70000-0x0000000006BD6000-memory.dmp

Filesize
408KB

Download
memory/3180-170-0x0000000000110000-0x00000000004BC000-memory.dmp

Filesize
3.7MB

Download
memory/3180-171-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads