44caliber | 694175c88d632f08a6ad09a9be03aac4a82432cc5c3cc0e3e3dfdd7f360af651

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
006d8441e7fced79d603807b0581f171_JaffaCakes118.exe
Size 801KB
Sample240622-asp4fsxhqa
SHA256 694175c88d632f08a6ad09a9be03aac4a82432cc5c3cc0e3e3dfdd7f360af651
MD5 006d8441e7fced79d603807b0581f171
SHA1 a14aca213e51b7e78d31f89724a183099d8a72ba
SHA512 5907b4f4b92b80c10e19cea4e6d837605b4630517eecd6cb1a2eb37eaab5356315368813fe3fa56a1bb7b1c6855c088e6d3c4a2a8786b03bf3c598bd4a49a1f6
SSDEEP 12288:75l3YBlSA8NlmWzFJ74xQUlQDI/LftxL4/MF4o0pUi6iKH0F0ZCqtl1RB0Ce2y:7n5lmWzFJ74xQUlQDI/znEVxKUGJtFSR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

44caliber persistence spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/810239957884600360/6U33lkHJ7xVaXUnK4MdVL0Cl2jQOZSItumW0MlC9caow-63YRupBuBGsE5KGDmJgIIFC

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\ProPlayer\\Player.exe.exe"	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3824 set thread context of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
624	4540	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4540	RegSvcs.exe
4540	RegSvcs.exe
4540	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81
PID 3824 wrote to memory of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81
PID 3824 wrote to memory of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81
PID 3824 wrote to memory of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81
PID 3824 wrote to memory of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81
PID 3824 wrote to memory of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81
PID 3824 wrote to memory of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81
PID 3824 wrote to memory of 4540	3824	006d8441e7fced79d603807b0581f171_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\006d8441e7fced79d603807b0581f171_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\006d8441e7fced79d603807b0581f171_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 1200
    3⤵
    - Program crash
    PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4540 -ip 4540
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks.txt

Path C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

memory/4540-4-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/4540-5-0x00000000747CE000-0x00000000747CF000-memory.dmp

Download

memory/4540-15-0x00000000747C0000-0x0000000074F70000-memory.dmp

Download

memory/4540-40-0x00000000747C0000-0x0000000074F70000-memory.dmp

Download