Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 03:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe
Resource
win7-20230831-en
4 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe
-
Size
358KB
-
MD5
d7d792167c66e484b13329d256411f1c
-
SHA1
394edb1d544ff3df3c05b6d1c1b1d913e17012e9
-
SHA256
658bdee8061c5f57428ff71109a1c54a4a65d959c65e9cfe6ec7bcefaa0d71ed
-
SHA512
c5394b4c7e2ec12e68edcf5a55ff427c89a547e94b2936f3033983aca007da9687408bc325cffee91b9c00d672a5a045716f16fd1e01ecf3ec640f60913effaf
-
SSDEEP
6144:Q4jra0nHNkkhzSSWyIBHb4AOxsd/g7Eu6A7L7hqiLeguFB8fi:Q4vfnHy++l4zsd/gQSJSgur8fi
Malware Config
Signatures
-
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral2/memory/4808-0-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4808-1-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4808-2-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4808-3-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4044 set thread context of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85 PID 4044 wrote to memory of 4808 4044 SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.KillProc2.21458.18745.414.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:4808
-