Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10source_prepared.exe
windows7-x64
7source_prepared.exe
windows10-2004-x64
9discord_to...er.pyc
windows7-x64
3discord_to...er.pyc
windows10-2004-x64
3get_cookies.pyc
windows7-x64
3get_cookies.pyc
windows10-2004-x64
3misc.pyc
windows7-x64
3misc.pyc
windows10-2004-x64
3passwords_grabber.pyc
windows7-x64
3passwords_grabber.pyc
windows10-2004-x64
3source_prepared.pyc
windows7-x64
3source_prepared.pyc
windows10-2004-x64
3Resubmissions
31/01/2025, 14:23
250131-rqf67sxqhw 10Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 14:23
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
discord_token_grabber.pyc
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
discord_token_grabber.pyc
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
get_cookies.pyc
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
get_cookies.pyc
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
misc.pyc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
misc.pyc
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
passwords_grabber.pyc
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
passwords_grabber.pyc
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
source_prepared.pyc
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
source_prepared.pyc
Resource
win10v2004-20241007-en
General
-
Target
source_prepared.exe
-
Size
84.4MB
-
MD5
fda00911ea38642cda92d787e072d737
-
SHA1
886715865119d72ccd2c84644bc8a6873e448753
-
SHA256
d256dee9c18ee54f961cc3d5295c5f6553e48979842da301a63be43969e7ccd7
-
SHA512
c1fe959a022f6149db21666246196db0ab23e91117ea8ea87c1862372d3ab15bbe0fb20bcf871468e355de2539892e303a83e8479059d175630a95d5ab97804b
-
SSDEEP
1572864:FVjl4WwZXm7OkiqOv8im2A3+TUE7slh+eiYweyJulZUdgKXUxjCHZvkOgs1:3+7ZXm7OknOv8i36+TCLkpumX2okO5
Malware Config
Signatures
-
Loads dropped DLL 10 IoCs
pid Process 1908 source_prepared.exe 1908 source_prepared.exe 1908 source_prepared.exe 1908 source_prepared.exe 1908 source_prepared.exe 1908 source_prepared.exe 1908 source_prepared.exe 1908 source_prepared.exe 1908 source_prepared.exe 1908 source_prepared.exe -
resource yara_rule behavioral1/files/0x0003000000020b71-1329.dat upx behavioral1/memory/1908-1331-0x000007FEF5A20000-0x000007FEF60F8000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1908 2420 source_prepared.exe 30 PID 2420 wrote to memory of 1908 2420 source_prepared.exe 30 PID 2420 wrote to memory of 1908 2420 source_prepared.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:1908
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2000
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD543034b2a0c12a90703a5a675c3281875
SHA1a0fb6671dfde8dca91b2695a509da39c241d4cba
SHA256ed56b23081e1b4a9d656f5303522f9706962c64a39be5ac4103c7a4bb4683493
SHA512d99c8cde439fd36b525672b14819033c9e81d35e3ac4d1e99a13a122219567da34044539b22c915c0bb2ae9c2a7e80a34d65431a5f443bd39bc6604cd414a8bc
-
Filesize
41KB
MD501a3313a97977282f26db06f15b5b1d2
SHA1a0888fdbcf4ed3e80ad45251a998c42e77f81790
SHA25689d6baa7e95b44903dd16c011b3d8bc8633bead728ef08d134933a995a71f4fa
SHA5125ea9b970b617508c768e8ad37e0d89a51246789f1a9b95e6a59ca446a2088405cf6eab4c0b8028455d87dd5fe819ef5bb400aa824a3f7a6adb3fc42febf0554c
-
Filesize
41KB
MD5e2f631cea6f1777d19de7b8f77ec852e
SHA1fb3aa9801e7365eb903d1b931e502aea7ef75f97
SHA2563612ca27d8ae67d620033d5310b0f9ad4bde1e902152c519c276a12e9410e643
SHA5127385342c7d7a202619c802355e48250cfc59af4d3c6864909ec8c3743a5c20a45c96214a5f66639f04f011c320be059d9e3e99ca9b7479c39809fa8151c9a41b
-
Filesize
41KB
MD507e60c794a1c936607e432bbd7678c3b
SHA1c368d8cc7ed4cb92ef4298b956e9609da09e934a
SHA256cf44707c8b430b6dda0de73248f1568ac4a844a46e9669b9e990476e6ce38e25
SHA512aebb8a6b8f07a21ca7be407471eba2734e241511732326739ea5e9457532b469779e5916e2a82b89672d65eed9df5ab6252b4420d6f88125390e0caa3fde751f
-
Filesize
41KB
MD512c396b06ce51331cf9c1969e6877711
SHA1278e0308a2b82de1162496b0f4796e27c72015a1
SHA256aee13ba0406ac447c2a4ef6a5a08f87b3867d0a23ebdc1d941b92ce831f30a3a
SHA512cb00e40d980b3a576012712263cbc523c06ea32aa7d70e7c6c192405ec150e5adb83d5b4daf27c6f79fbd98f1b34a8ec71ee57ecc771f0ff131df3e724d9a585
-
Filesize
41KB
MD590921e5f13b3802a85d168c37a33bc40
SHA136bf20e3a739511d506b0b89001be1c144d3a022
SHA256a013569c40698983a5d5d5ff1ce4189d00e2c4810c6ffd3d18453067390b3eae
SHA512af3c3bd51b51b093fb1f5450b3cdd921e2e9ba4a4f6b8948626939d442a85437d093266e306d77ce679b285f433fe7ae00c0d827b8775cdaa928ebd641014674
-
Filesize
41KB
MD5cb4a7cfd345a7524fcf8d55b914ab5d8
SHA1c282ab5761a900333d02d7041a137efe0a856c02
SHA256304944b6bd9c5b87e6607eaff5c1c473f48b952bb02545f195fafa610d6efc3f
SHA51287c67cadc9adf0135f990e29668d8b9c8c6845bc8deef1deba062294d9568f7bebe22531fbcd89ab22da9ceda481d97ed9bb8e55ab67fe3a12fbb3c922b5a850
-
Filesize
41KB
MD5abaa8d09a78200136033fa73610712c7
SHA1bc39ef62b6d61c6952d3892becb194658c3a04b5
SHA256c7f6425686a642c43554840add5ae1bc865e1525acab93598b5857e4b0b0f09d
SHA51240ba5011a208ede2c5f9e1f93a41a064f70c27194a33f92b03dcf727516642a19a27a68daab9ac37b0baa82476318bfb02bd3b3eb735a65cd4e804497e23e705
-
Filesize
1.8MB
MD5cfa2e5cdda9039831f12174573b20c7b
SHA1c63a1ffd741a85e483fc01d6a2d0f7616b223291
SHA256b93e682bddb5c3e2af1f0264e83fbc40481fe6abd90c3ab26e94f246c8ce8d7d
SHA512f1ac568bd1a16d5ab2623ac42a83aed32d9867a0e016e0ac3c922f28ceb1bb7e114dab44553949008a6e2fd3bb67fc2be8fc283560d9f4b1f1552137a0c104aa
-
Filesize
1.3MB
MD59ccd6181c279edbbb602249f245c1001
SHA14fb78797395f2e5b08663c7e2e5eb89784581da2
SHA2564963a3530382aae748ca76b5d113b828f7d402e0890a4e8e0fba6ea47c8ccc5e
SHA5122699708384f2bd2adb797b72f82c311844b6e79a40309ca860d98d91a1a02d8abcf8c4d8d137f1291882ee6f70b10dbc691f841c53082db63df385ffeffb1844