Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
3916-1786-0x0000000000FF0000-0x000000000168C000-memory.exe
Resource
win7-20240903-en
General
-
Target
3916-1786-0x0000000000FF0000-0x000000000168C000-memory.dmp
-
Size
6.6MB
-
MD5
6a365b1bf5a5ff4e96e2dc40baae8a65
-
SHA1
fc848bd62f117de73ab8461098e2d3f5bfe51fe3
-
SHA256
dbb6077639c1acdb880ef247ce5f777244318cf9740a4d8435eb87415e274424
-
SHA512
6aa21714f88bd1021b570f181e4f41a440aae18b7d97e52d9256e81e457f105ce9a671428e1c4b676244b54f0a72ef58d3585b47676c2723a42650d4b2972351
-
SSDEEP
49152:bbXAI+uVB4ff0wCOjNmF8kNO7BKSRCVSrKGuY4+at/SBQ5dgqgkMu2ZFNONxDvQ+:YI+gB4FCOhmFiMS2Y6ZSi59gttLOl
Malware Config
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3916-1786-0x0000000000FF0000-0x000000000168C000-memory.dmp
Files
-
3916-1786-0x0000000000FF0000-0x000000000168C000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ggjuwakl Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jxhbbivq Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE