Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23/12/2023, 15:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231129-en
2 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
448KB
-
MD5
700a9938d0fcff91df12cbefe7435c88
-
SHA1
f1f661f00b19007a5355a982677761e5cf14a2c4
-
SHA256
946583a0803167de24c7c0d768fe49546108e43500a1c2c838e7e0560addc818
-
SHA512
7fa6b52d10bcfc56ac4a43eda11ae107347ba302cc5a29c446b2d4a3f93425db486ed24a496a8acd87d98d9cfb8cad6505eb0d8d5d509bc323427b6931c8fff8
-
SSDEEP
6144:btb2kbTOXb1JSqar6LNzVLReCCOQ6j4zu+jf6U5peQRVOm+T:MaTOqq+6LNzjwxPfhCQRVOmW
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 4 IoCs
resource yara_rule behavioral2/memory/4640-2-0x0000000002610000-0x000000000268C000-memory.dmp family_lumma_v4 behavioral2/memory/4640-3-0x0000000000400000-0x0000000000892000-memory.dmp family_lumma_v4 behavioral2/memory/4640-4-0x0000000000400000-0x0000000000892000-memory.dmp family_lumma_v4 behavioral2/memory/4640-5-0x0000000002610000-0x000000000268C000-memory.dmp family_lumma_v4 -
Program crash 1 IoCs
pid pid_target Process procid_target 4476 4640 WerFault.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵PID:4640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 6722⤵
- Program crash
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4640 -ip 46401⤵PID:3092