strela | 1e7277d2aef459eea9646a76032f1bd4384f7cedac8f4cff3670a601307ab25a | Triage

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-06-2023 12:03

Sharing

Report Analysis Logs

General

Target

01338899.dll
Size

325KB
MD5

97c4dc2b0307ce4aeb24e686fdee6b50
SHA1

0d89a517f48732bb04744da77985fa48c70e2ef3
SHA256

1e7277d2aef459eea9646a76032f1bd4384f7cedac8f4cff3670a601307ab25a
SHA512

9ce38aca4cde2eb0a49141dc8b9007caedd384d802a94ececd1d506b9e4fafbb91ca9baded3af9098cf73cc6525093699035791de1741e0cc152b3c45084c074
SSDEEP

3072:2U2nZkUW9CI+hGwu1xb7xPSPZEm6rLVoGU98nPabRIYFUlSxc2hNl6ixqq/cv/w0:2Vn8Hx6laSXnhzsYqtplWi88EssTKhn

Score

10^/10

strela spyware stealer

Malware Config

Extracted

Family

strela

C2

91.215.85.209

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01338899.dll,#1
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2032-55-0x000000006D7C0000-0x000000006D819000-memory.dmp

Filesize
356KB

Download
memory/2032-56-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download