44caliber | 4f075208c4a73e0233240f7ed3bb26f4bb750167d5b419d4ed619eeb449254ec

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
Size

533KB
MD5

44a5c905d738a570bf4bc0fdc7fcb2f5
SHA1

e8c719c5db68ac5f4a54d15a08b630eabc80b160
SHA256

4f075208c4a73e0233240f7ed3bb26f4bb750167d5b419d4ed619eeb449254ec
SHA512

1dcd4ccab7ecd31d109f195d1e902d9457ffdccc476d7156f817446eab33368b5e294d10e33b7028eee0d53bcdb8e47f7e4f2bf7cf9ab2d57e56c3a2038795af
SSDEEP

12288:E93uV1kGdQ97QDQh0KnRmAdGi00OFDXBSEOHnMLB2fdY0:GC15wkkhvYAdH0brMplfd

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
44Caliber family
44caliber
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	freegeoip.app
5	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2304	JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
2304	JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
2304	JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
2304	JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
472B

MD5
4e83a5421da5461897cf1d2ce0df4963

SHA1
8d52a9fa003717d1f7498d2bb295b2610b073f99

SHA256
d2886abd936a3047b14e7ebf2c7137373bbc8e035493a4508b4c0f2693405cef

SHA512
92f544cadd8199be0f8727519a243f672fc4823072347566a336a6736a66f9772ecf6b59fbdce14553a26eba93a0b881808e3522d26ecf4b9aff9f8c4ba3e897

Download Submit
memory/2304-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

Filesize
4KB

Download
memory/2304-1-0x00000000013D0000-0x000000000145C000-memory.dmp

Filesize
560KB

Download
memory/2304-2-0x000000001AD30000-0x000000001AE0A000-memory.dmp

Filesize
872KB

Download
memory/2304-3-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2304-4-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/2304-56-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download