strela | f114de58d079600d41677375080a2abbef8a46d04eb84a0941c91b64192c6179

General

Target
204101633414270_JC.js
Size 5.0MB
Sample230905-ssvm2sgd6v
SHA256 f114de58d079600d41677375080a2abbef8a46d04eb84a0941c91b64192c6179
MD5 6086fc77346086cd6a1cb9ac78045caa
SHA1 b2673c323390d38345095b5bfd3dc3f4f773bbf5
SHA512 bf169f17cfa5317d9dde20bb430dffc9ba507b18879654ff2d1541564e368249b38254940ac56d66aee35c8a0ee724380a6419e7b0114395ae4438046849aa04
SSDEEP 49152:sxu8oYjz0TVhgZuTrj2wTjR/JLQ4yJojqUbUz:Ici
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
712	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B2D1BF24-1F6D-418E-9357-9D0C22BE2D45}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 2028	3476	wscript.exe	85
PID 3476 wrote to memory of 2028	3476	wscript.exe	85
PID 2028 wrote to memory of 4536	2028	cmd.exe	89
PID 2028 wrote to memory of 4536	2028	cmd.exe	89
PID 2028 wrote to memory of 3452	2028	cmd.exe	90
PID 2028 wrote to memory of 3452	2028	cmd.exe	90
PID 2028 wrote to memory of 712	2028	cmd.exe	91
PID 2028 wrote to memory of 712	2028	cmd.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\204101633414270_JC.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\204101633414270_JC.js" "C:\Users\Admin\AppData\Local\Temp\\ruralexcuse.bat" && "C:\Users\Admin\AppData\Local\Temp\\ruralexcuse.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\findstr.exe
    findstr /V talentedinsect ""C:\Users\Admin\AppData\Local\Temp\\ruralexcuse.bat""
    3⤵
    PID:4536
- - C:\Windows\system32\certutil.exe
    certutil -f -decode wrongamused fairiesunequal.dll
    3⤵
    PID:3452
- - C:\Windows\system32\regsvr32.exe
    regsvr32 fairiesunequal.dll
    3⤵
    - Loads dropped DLL
    PID:712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fairiesunequal.dll

Path C:\Users\Admin\AppData\Local\Temp\fairiesunequal.dll
Size 3.7MB
SHA256 72416c54085f154e94597a825ff8ef7589cce4c4ce9f7d893c9306f04a15ef25
MD5 a62759a244945dc6be0beaa49046187a
SHA1 858fe557ecedbdb9f2432f091cdae353a526a397
SHA512 2a76014b81e0828ac3f6692291b5d463be2322d5de41ef0d8bdd2b600d8c53a6463ff516ee2ba1a166fa7fc70b624a98a93f650b1fcd00d249d8fe912b6bd415
SSDEEP 24576:cr4niewxYkgCYRLGoyMj65cDTnRScL0e6Ud4QC1XXC1e3ZpFfdPgff200mlf4TQv:tnzsuSe0eyQkFfdohoU1wX91I
MD5 SHA1 SHA512 SSDEEP

Submit Download

fairiesunequal.dll

Path C:\Users\Admin\AppData\Local\Temp\fairiesunequal.dll
Size 3.7MB
SHA256 72416c54085f154e94597a825ff8ef7589cce4c4ce9f7d893c9306f04a15ef25
MD5 a62759a244945dc6be0beaa49046187a
SHA1 858fe557ecedbdb9f2432f091cdae353a526a397
SHA512 2a76014b81e0828ac3f6692291b5d463be2322d5de41ef0d8bdd2b600d8c53a6463ff516ee2ba1a166fa7fc70b624a98a93f650b1fcd00d249d8fe912b6bd415
SSDEEP 24576:cr4niewxYkgCYRLGoyMj65cDTnRScL0e6Ud4QC1XXC1e3ZpFfdPgff200mlf4TQv:tnzsuSe0eyQkFfdohoU1wX91I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ruralexcuse.bat

Path C:\Users\Admin\AppData\Local\Temp\ruralexcuse.bat
Size 5.0MB
SHA256 f114de58d079600d41677375080a2abbef8a46d04eb84a0941c91b64192c6179
MD5 6086fc77346086cd6a1cb9ac78045caa
SHA1 b2673c323390d38345095b5bfd3dc3f4f773bbf5
SHA512 bf169f17cfa5317d9dde20bb430dffc9ba507b18879654ff2d1541564e368249b38254940ac56d66aee35c8a0ee724380a6419e7b0114395ae4438046849aa04
SSDEEP 49152:sxu8oYjz0TVhgZuTrj2wTjR/JLQ4yJojqUbUz:Ici
MD5 SHA1 SHA512 SSDEEP

Submit Download

ruralexcuse.bat

Path C:\Users\Admin\AppData\Local\Temp\ruralexcuse.bat
Size 5.0MB
SHA256 f114de58d079600d41677375080a2abbef8a46d04eb84a0941c91b64192c6179
MD5 6086fc77346086cd6a1cb9ac78045caa
SHA1 b2673c323390d38345095b5bfd3dc3f4f773bbf5
SHA512 bf169f17cfa5317d9dde20bb430dffc9ba507b18879654ff2d1541564e368249b38254940ac56d66aee35c8a0ee724380a6419e7b0114395ae4438046849aa04
SSDEEP 49152:sxu8oYjz0TVhgZuTrj2wTjR/JLQ4yJojqUbUz:Ici
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrongamused

Path C:\Users\Admin\AppData\Local\Temp\wrongamused
Size 4.9MB
SHA256 42f7169ce9e0568977495f76259519fa35d76d3a571238086ca5745677b92c10
MD5 e890caf038cbd6683a62ba847ca5a2e8
SHA1 62877c2b44758e9bb61216f7e0718c282228ba50
SHA512 7a874f413659f6ed62882598d3a0f8c16a3fd33e78e733bb24216f4d74511417f0aae642c2c7284b5bc58ee27936340a711a57a4376153e1712d8344376ab563
SSDEEP 49152:Xxu8oYjz0TVhgZuTrj2wTjR/JLQ4yJojE:5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/712-5687-0x00000000020D0000-0x00000000020F1000-memory.dmp

Download

memory/712-5688-0x000000006D7C0000-0x000000006DB71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads