44caliber | c55472156a4049406afc1b44bbe5b6b6899a83a3e6fbb5fd9d14d85886c7c2aa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe
Size

880KB
MD5

d7ed4cfa850622ed71171ddec552ed6c
SHA1

8b0a8f4268444c2a8c2807a668ba28eb955d8d11
SHA256

c55472156a4049406afc1b44bbe5b6b6899a83a3e6fbb5fd9d14d85886c7c2aa
SHA512

e146606f41ff87a14df0084b9fef476c187be5fe184319610ecf10d427f1b6afacb310a43e1e87d26f2e52141c51efea18cca634e6a91bb739ccbe268d8a74aa
SSDEEP

12288:Bdcd8jFKGUJmQCyCs/RGbkhuVRDa3fXE6Rc4q2l/edmZfOE7xxLML9u7BAlIrbqR:BdtjFKDVCs5NMVzMJnq/

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
44Caliber family
44caliber
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	freegeoip.app
4	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1388	JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe
1388	JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe
1388	JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe
1388	JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d7ed4cfa850622ed71171ddec552ed6c.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
740B

MD5
27739465bd5b4deccfed6e4c222707ab

SHA1
2511900241e6751fe4abbcb2bdcc451b3a1e8062

SHA256
42629fca69164addd97b5730c1709ff3e839df2b81a6766e8fff3f2840ea5ae3

SHA512
38ddd12aa362902c5b9afbaf2699775cf76ade4329affea6b5c403d38d570772a61d660edabfa0d54f74cb9df9d37a25b7d612252952000a4d179949555265be

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
bbdd6b35ab134bf16a68310e5df1f510

SHA1
7c79806e47793646ccb661e42ce7ec7d0ea88bd6

SHA256
659c5a8fefef9067464323acdddffd9d978720ee4cc95e7c336d02c90eede39e

SHA512
deb67e356bb64e58c3f72e106fb2b840d03e2e97e0a81681eee924121acd36259aa8439bc781361cd8aec53dd8838f9f9acf8e54bfb752c378408cba71777c9a

Download Submit
memory/1388-0-0x00007FFEEB9B3000-0x00007FFEEB9B5000-memory.dmp

Filesize
8KB

Download
memory/1388-1-0x0000000000E00000-0x0000000000EE2000-memory.dmp

Filesize
904KB

Download
memory/1388-2-0x0000000001690000-0x0000000001696000-memory.dmp

Filesize
24KB

Download
memory/1388-22-0x00007FFEEB9B0000-0x00007FFEEC471000-memory.dmp

Filesize
10.8MB

Download
memory/1388-119-0x00007FFEEB9B0000-0x00007FFEEC471000-memory.dmp

Filesize
10.8MB

Download