Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/08/2023, 15:16

General

  • Target

    1cf8dee2b9563a6861c46ca56e9b79949ef48cc63bf2a9448bfe1b6f48681a92_JC.exe

  • Size

    457KB

  • MD5

    30b1cabb2920c8bc5e2452f859b19156

  • SHA1

    aa7cda2663cfec324f21d30ccf20ec49573552ff

  • SHA256

    1cf8dee2b9563a6861c46ca56e9b79949ef48cc63bf2a9448bfe1b6f48681a92

  • SHA512

    c81d11684c38eebc8c761d312c3729bdef388b046de24e5fae7d03d3e48e94ef5af2f827fdf3d7030d06e166715c4ec675143686bfb1e1f50afe9d6e80509c3f

  • SSDEEP

    12288:znzx/uESku/uowlkDXDwBO/+8ea0wPFixdwR:z9mEStuoeqTkKP90HwR

Score
10/10

Malware Config

Signatures

  • Detect rhadamanthys stealer shellcode 4 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1cf8dee2b9563a6861c46ca56e9b79949ef48cc63bf2a9448bfe1b6f48681a92_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1cf8dee2b9563a6861c46ca56e9b79949ef48cc63bf2a9448bfe1b6f48681a92_JC.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 484
      2⤵
      • Program crash
      PID:644
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1872 -ip 1872
    1⤵
      PID:5048

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1872-133-0x0000000001B50000-0x0000000001B99000-memory.dmp

      Filesize

      292KB

    • memory/1872-134-0x0000000003580000-0x00000000035F3000-memory.dmp

      Filesize

      460KB

    • memory/1872-135-0x0000000000400000-0x00000000018F0000-memory.dmp

      Filesize

      20.9MB

    • memory/1872-136-0x0000000000400000-0x00000000018F0000-memory.dmp

      Filesize

      20.9MB

    • memory/1872-137-0x0000000001B50000-0x0000000001B99000-memory.dmp

      Filesize

      292KB

    • memory/1872-138-0x0000000003580000-0x00000000035F3000-memory.dmp

      Filesize

      460KB

    • memory/1872-144-0x00000000001D0000-0x00000000001D7000-memory.dmp

      Filesize

      28KB

    • memory/1872-145-0x0000000003940000-0x0000000003D40000-memory.dmp

      Filesize

      4.0MB

    • memory/1872-146-0x0000000003940000-0x0000000003D40000-memory.dmp

      Filesize

      4.0MB

    • memory/1872-147-0x0000000003940000-0x0000000003D40000-memory.dmp

      Filesize

      4.0MB

    • memory/1872-148-0x0000000003940000-0x0000000003D40000-memory.dmp

      Filesize

      4.0MB

    • memory/1872-149-0x0000000000400000-0x00000000018F0000-memory.dmp

      Filesize

      20.9MB