Analysis
- max time kernel
7s - max time network
8s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
05/07/2023, 12:31
General
- Target 4170ba635a24ada6c8de5430a1ad9f2f1414db4ae44a548de1e8099d1228dde1.dll
- Size 174KB
- Sample230705-pp777acc35
- SHA256 4170ba635a24ada6c8de5430a1ad9f2f1414db4ae44a548de1e8099d1228dde1
Score
10/10
Malware Config
Extracted
Family
-
strela
C2
-
91.215.85.209
Signatures
- Strela
An info stealer targeting mail credentials first seen in late 2022.
- Blocklisted process makes network request 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4170ba635a24ada6c8de5430a1ad9f2f1414db4ae44a548de1e8099d1228dde1.dll,#11⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5088-133-0x000002468D940000-0x000002468D961000-memory.dmp
memory/5088-134-0x000000006BEC0000-0x000000006BEF3000-memory.dmp
memory/5088-135-0x000002468D940000-0x000002468D961000-memory.dmp