Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2024, 13:46

General

  • Target

    2188-106-0x0000000000890000-0x0000000000FBC000-memory.exe

  • Size

    7.2MB

  • MD5

    c0f300dc92f693140af5bf2ef466b685

  • SHA1

    c9f3eea116fb16c8576694f1d383595e93c1b25a

  • SHA256

    11029d3de68cfc4751c2836b1bec6069705fad8dbea96b5dfb4ca4d76deb68ce

  • SHA512

    990ecff5a0545fe54832bdb77abc3d4976c82b392885c2de3a501d18822ce953cfad03e46262e0efe7f5a3a7d92089527c29b045c3f19e8d21146145370aed76

  • SSDEEP

    98304:q6GJtF4RIwybvxnr+3R4aZoauOAmVBA8kvoG43nDHfuMxl4twB9RK:hGh6ybvaFk8PGqHfuheK

Malware Config

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2188-106-0x0000000000890000-0x0000000000FBC000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2188-106-0x0000000000890000-0x0000000000FBC000-memory.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 216
      2⤵
      • Program crash
      PID:4116
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4936 -ip 4936
    1⤵
      PID:3596

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4936-0-0x0000000000DB0000-0x00000000014DC000-memory.dmp

      Filesize

      7.2MB