Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
1360-54-0x0000000000400000-0x000000000043D000-memory.exe
Resource
win7-20220812-en
General
-
Target
1360-54-0x0000000000400000-0x000000000043D000-memory.dmp
-
Size
244KB
-
MD5
097a1459a25e8bdac89d5daa8416232f
-
SHA1
053506f8b51ee967e44292aa05270820a54b3b0a
-
SHA256
15fd6217571527b13ef103ba73f41a90c48f35b6c9a074c80d81e16019430e39
-
SHA512
1a1e5f576f17e1398147fc60c5f0eb855fe09f0e2421c85c17ffbf01ad9514edbc7e7ca3bb392297d55f2fe481b69c8f91f414a0a659ee656395311b254d65be
-
SSDEEP
3072:Um/E8k9ZjpIL+zNch12KbAwSaSOJSp8Pb8EG:N/E8k91zz6/tn8EG
Malware Config
Extracted
marsstealer
Default
Signatures
-
Marsstealer family
Files
-
1360-54-0x0000000000400000-0x000000000043D000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 114KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 33KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 864B
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE