Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/12/2024, 00:44

General

  • Target

    428-119-0x0000000000020000-0x00000000006B3000-memory.exe

  • Size

    6.6MB

  • MD5

    aace740365f541abe52aab03e68d598c

  • SHA1

    c9a5d1729a10aeb0b4d6969e07ed6b739f401106

  • SHA256

    d446caadad856b9519e123a5e4826ec42d9f8ba9f57bfdad23f4c734ff9d193c

  • SHA512

    fb38c9c9391b79642dfe8f215354751850656c95b03717b300f266ec18df286e1764d5cfeffaffb14562d5dbd22cd94d69d20e037107aaa0b62052c985b7e430

  • SSDEEP

    49152:qQozDp6VWq+f53TRoRB3RIcsuyRzYZZWPFQX2xjy7GF1rbutHuu0LcNrFjoH9np:4nAVWq+f5iFVsQXejy67mZuuM8oV

Malware Config

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\428-119-0x0000000000020000-0x00000000006B3000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\428-119-0x0000000000020000-0x00000000006B3000-memory.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 216
      2⤵
      • Program crash
      PID:4916
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3144 -ip 3144
    1⤵
      PID:3008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3144-0-0x00000000004A0000-0x0000000000B33000-memory.dmp

      Filesize

      6.6MB