Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2024, 15:50

General

  • Target

    2744-28-0x0000000000380000-0x0000000000A15000-memory.exe

  • Size

    6.6MB

  • MD5

    f1b3e9913da6db4cc723dc3399925e19

  • SHA1

    90abe5d846bd2d9d5ef1437b57c540a3e29426f4

  • SHA256

    fcab1a2d575f6ab21b476f4999921117b1571b8c8cfe27e88f590c6829f41935

  • SHA512

    a2de3f292bf1aa600a1a74b73d39a20b42e5f284c57db0e9a0dc1d92d91b7b8b7e267dc190589e0d0e649d16522166bffa634e1c9e9855197489d1e7dab20081

  • SSDEEP

    98304:lT6QBfFi9IfVwKboZE2N3DoepAYASdPyRGGkBfoFaE9P:BhEZE2NDTASdqRZaE

Malware Config

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2744-28-0x0000000000380000-0x0000000000A15000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2744-28-0x0000000000380000-0x0000000000A15000-memory.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 204
      2⤵
      • Program crash
      PID:720
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4624 -ip 4624
    1⤵
      PID:2780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4624-0-0x0000000000AD0000-0x0000000001165000-memory.dmp

      Filesize

      6.6MB