Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2528-3-0x0000000000020000-0x000000000051E000-memory.exe
Resource
win7-20240903-en
General
-
Target
2528-3-0x0000000000020000-0x000000000051E000-memory.dmp
-
Size
5.0MB
-
MD5
495193dd7eacc5d27a5481be13b50b8c
-
SHA1
ee66155e2c55dc7c1418d584a27f4185fcb066a5
-
SHA256
ad7125f6a28719ec617c4dec085b174177bc254b1e5420884d468f6fd462ab29
-
SHA512
c9ab06ecba72dcf579dd6a4b4b3dac99aecd647cbf47f89de28c1b57275155a214dbfecabec74e5393874c98f3287831d6ba33b5f8a0d54c2923a2730a0c6006
-
SSDEEP
49152:fDSfv1hZ3bCD872uazzKdePOIfzn92Cihh1T1:+1hZL52dyIfznbqvJ
Malware Config
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2528-3-0x0000000000020000-0x000000000051E000-memory.dmp
Files
-
2528-3-0x0000000000020000-0x000000000051E000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gngdpjhn Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
poaqzqjh Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE