Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2172-18-0x0000000000400000-0x0000000000431000-memory.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2172-18-0x0000000000400000-0x0000000000431000-memory.exe
Resource
win10v2004-20240709-en
General
-
Target
2172-18-0x0000000000400000-0x0000000000431000-memory.dmp
-
Size
196KB
-
MD5
4bc3159684024a537ef93ac3da0bf6f6
-
SHA1
bb33f62a69fc56b972f2e23f9d568ca8043c703d
-
SHA256
5acbb9c9cfc39bff4197bffae6046fc300652e72b4b417d83a8299f157392ad4
-
SHA512
7e320a345a3ae9022048ee0e154bd435fbba592496711d732958a5649fbca6b339b49afb2ed5fd93feadc236c9e94048a202c85f5c52fdf6cfd773f1fd70f54d
-
SSDEEP
3072:H4P7/e9rGzaTeY7Sq76aS+TajpmLA0fNrcRMEE:H4P7/emsSOTaj6Aa5qMEE
Malware Config
Extracted
arkei
Default
coin-file-file-19.com/tratata.php
Signatures
-
Arkei family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2172-18-0x0000000000400000-0x0000000000431000-memory.dmp
Files
-
2172-18-0x0000000000400000-0x0000000000431000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ