Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2084-3-0x0000000001080000-0x000000000157A000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2084-3-0x0000000001080000-0x000000000157A000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2084-3-0x0000000001080000-0x000000000157A000-memory.dmp
-
Size
5.0MB
-
MD5
eade2ae58c16e8f71d2118e625de3920
-
SHA1
688ba73ef373a6b5b3bbe47cc38998523fcdb343
-
SHA256
bf35a1c3faf4387c01f227525bac6b4f3684b21f0e9ced3b23a8dbe500e96461
-
SHA512
90faa80b5136f135719d4b94d2e644fbd6ff71ec3d8c4a693f901c4eab6b7fc8434756827f5204119f670016095ad10b4097b830ec73e4fccda9027e81f7b092
-
SSDEEP
49152:QEF+v6ZgxSYOJsjWascaznyyrL77BUL+K4FGyrf14:Q6g0YOJCWtc8nyq7GL+nGyr
Malware Config
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2084-3-0x0000000001080000-0x000000000157A000-memory.dmp
Files
-
2084-3-0x0000000001080000-0x000000000157A000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
drmmbjfe Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ukkuhbav Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE