Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
3356-0-0x0000000000700000-0x0000000000D92000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3356-0-0x0000000000700000-0x0000000000D92000-memory.exe
Resource
win10v2004-20250129-en
General
-
Target
3356-0-0x0000000000700000-0x0000000000D92000-memory.dmp
-
Size
6.6MB
-
MD5
4e3e23b4cece859842f7a00e66955159
-
SHA1
3122945301d2488c4223a539cf251155426ee0f0
-
SHA256
1f7952821d045e89e832877ca3689ba134e459231380b3e37649e262b462b378
-
SHA512
81f3530d8390d9f4a6c8b9f6714b38406a78c19efe06310c18b464ae8bb63f42f7c3f1a2368e1413a88d299d87e363c74b48b3ddc035eb87ee37c339f1cd4ab7
-
SSDEEP
3072:zGHVnV+SJEErejk9CZgVRLb9pNc+FVBOX6WKTLCFD3C0bWyghbEMJ:aVV1JmjYJNc+Hs6H/gSfZwi
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3356-0-0x0000000000700000-0x0000000000D92000-memory.dmp
Files
-
3356-0-0x0000000000700000-0x0000000000D92000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jlhkaomn Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xthnuecw Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE