Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 00:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe
-
Size
359KB
-
MD5
e8ef87c361c09e473bb3c5696defda77
-
SHA1
5d7c4a4f6c1202ddc18bcd7d193364819f2a62b7
-
SHA256
8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705
-
SHA512
96750b529f24c337ed97f3c12c8dd944548eab1af22478dfe6701423401bd84cab716ba800f8e0a23d4278b0478d5c8c361fab2485f3f12666332e5735912c23
-
SSDEEP
6144:iIcaGEZt20ZSwbz8+Dxe8kVAOhllXtEvw7Aos3n7FerIaAmW2jj3uLhtYvfIh8Ey:iIFzZtT78TXnCvw7Aos34rjAx2jj+LhG
Malware Config
Signatures
-
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral2/memory/3740-0-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3740-1-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3740-2-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3740-3-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 636 set thread context of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85 PID 636 wrote to memory of 3740 636 8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe"C:\Users\Admin\AppData\Local\Temp\8b3d3410b4c5a0a30488205a84b36245c80d6fc76d9561ffb9b241ef73656705.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:3740
-