Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23/12/2024, 15:42 UTC

General

  • Target

    2024-12-23_8dbc3098d25b7068fe0e4239361f89b8_mafia.exe

  • Size

    6.6MB

  • MD5

    8dbc3098d25b7068fe0e4239361f89b8

  • SHA1

    a89327bfc89c1394092c6b8ac276f21f6da579da

  • SHA256

    454465b4f79ec7af5bec9fa4a2c3c7750527bd9ad8759a9624b52de66d18fc50

  • SHA512

    d56cb4d2c10800014a366532b498f5e93594687b5e95014ba0d6ad6bd061f3af4df722f3e67d856d62494a145b835c571c6e4232920b0b6810c0acdc9d96bc8b

  • SSDEEP

    98304:BWIJ3WjHgaT1JUyjngAHNndfmAl9MK/nmO+ZNA:8HZ3UyjngAHNntmAfMK/nOZNA

Score
10/10

Malware Config

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Vidar Stealer 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-23_8dbc3098d25b7068fe0e4239361f89b8_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-23_8dbc3098d25b7068fe0e4239361f89b8_mafia.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 36
      2⤵
      • Program crash
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2716-0-0x0000000000C40000-0x00000000012D7000-memory.dmp

    Filesize

    6.6MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.