44caliber | 694175c88d632f08a6ad09a9be03aac4a82432cc5c3cc0e3e3dfdd7f360af651

General

Target

006d8441e7fced79d603807b0581f171_JaffaCakes118.exe
Size

801KB
MD5

006d8441e7fced79d603807b0581f171
SHA1

a14aca213e51b7e78d31f89724a183099d8a72ba
SHA256

694175c88d632f08a6ad09a9be03aac4a82432cc5c3cc0e3e3dfdd7f360af651
SHA512

5907b4f4b92b80c10e19cea4e6d837605b4630517eecd6cb1a2eb37eaab5356315368813fe3fa56a1bb7b1c6855c088e6d3c4a2a8786b03bf3c598bd4a49a1f6
SSDEEP

12288:75l3YBlSA8NlmWzFJ74xQUlQDI/LftxL4/MF4o0pUi6iKH0F0ZCqtl1RB0Ce2y:7n5lmWzFJ74xQUlQDI/znEVxKUGJtFSR

Score

10^/10

44caliber persistence spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/810239957884600360/6U33lkHJ7xVaXUnK4MdVL0Cl2jQOZSItumW0MlC9caow-63YRupBuBGsE5KGDmJgIIFC

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\ProPlayer\\Player.exe.exe"	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	2000	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2000	RegSvcs.exe
2000	RegSvcs.exe
2000	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2000	1700	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2560	2000	RegSvcs.exe	29
PID 2000 wrote to memory of 2560	2000	RegSvcs.exe	29
PID 2000 wrote to memory of 2560	2000	RegSvcs.exe	29
PID 2000 wrote to memory of 2560	2000	RegSvcs.exe	29

C:\Users\Admin\AppData\Local\Temp\006d8441e7fced79d603807b0581f171_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\006d8441e7fced79d603807b0581f171_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 816
    3⤵
    - Program crash
    PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-4-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-10-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-18-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-14-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2000-8-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-6-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-19-0x00000000741EE000-0x00000000741EF000-memory.dmp

Filesize
4KB

Download
memory/2000-21-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/2000-37-0x00000000741EE000-0x00000000741EF000-memory.dmp

Filesize
4KB

Download
memory/2000-38-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads