strela | 389c5f29a922e6ae38e9d4999b5b8149ad5bdc6378e733fb3581ccc272931e86

General

Target
FACTURA_1662927893.js
Size 4.9MB
Sample231012-ab3yzscg2t
SHA256 389c5f29a922e6ae38e9d4999b5b8149ad5bdc6378e733fb3581ccc272931e86
MD5 a639233c19489eace132ad82a42df5a4
SHA1 3035708facc5f29c8e7e4e6fe838d4cdf61e5c28
SHA512 50c9e2064461cc8d83bd67c2b79294608aac75f7fea4205227c8ea86e6a4d00bf0d666a5701f8660ab80a168eb3cec58ed16f6424767294e10e1a4aa5ba2b916
SSDEEP 24576:5haPEhagriP3yLbFNa0r0wQ5yzbLZoxE7m98Sn/dD2wxIt2VQi+k7lAcl5C70UVk:DagZgX0n57Yc2GnUbUm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
3380	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 5044	4824	wscript.exe	86
PID 4824 wrote to memory of 5044	4824	wscript.exe	86
PID 5044 wrote to memory of 2360	5044	cmd.exe	98
PID 5044 wrote to memory of 2360	5044	cmd.exe	98
PID 5044 wrote to memory of 2660	5044	cmd.exe	99
PID 5044 wrote to memory of 2660	5044	cmd.exe	99
PID 5044 wrote to memory of 3380	5044	cmd.exe	101
PID 5044 wrote to memory of 3380	5044	cmd.exe	101

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\FACTURA_1662927893.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\FACTURA_1662927893.js" "C:\Users\Admin\AppData\Local\Temp\\relationboat.bat" && "C:\Users\Admin\AppData\Local\Temp\\relationboat.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\findstr.exe
    findstr /V sparkcountry ""C:\Users\Admin\AppData\Local\Temp\\relationboat.bat""
    3⤵
    PID:2360
- - C:\Windows\system32\certutil.exe
    certutil -f -decode basinappliance raiseversed.dll
    3⤵
    PID:2660
- - C:\Windows\system32\regsvr32.exe
    regsvr32 raiseversed.dll
    3⤵
    - Loads dropped DLL
    PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

basinappliance

Path C:\Users\Admin\AppData\Local\Temp\basinappliance
Size 4.8MB
SHA256 c81378d0c4db5ecd7fe127bd57b3ad6f862f7251c4b3194884f6ffab4d893144
MD5 9e2fc13bfe9a18d32619db50a67078cf
SHA1 1f9b8210aa403aff1ce0bab460add1d975d1dfe9
SHA512 cc2c041f6a3a17f43cc9a3b30d9737f4ff77d254e20efb9f24fc71ab787ebe8d52558dadfaf1b8a0ebb17763ba700bdedca26a31dbc1c3b5ccd12f4ca75eb323
SSDEEP 24576:1haPEhagriP3yLbFNa0r0wQ5yzbLZoxE7m98Sn/dD2wxIt2VQi+k7lAcl5C70UVA:3agZgX0n57Yc2GW
MD5 SHA1 SHA512 SSDEEP

Submit Download

raiseversed.dll

Path C:\Users\Admin\AppData\Local\Temp\raiseversed.dll
Size 3.6MB
SHA256 815dcf03581b840e49038cb2d3bbfe6fe6e8a3d154ac361b93cec4abd404de01
MD5 9d11f9931b33a2a7a722a6c945eb844f
SHA1 36b18c79b54b8b0fe2b3db7e98f2ee147317c9ce
SHA512 55b78f03e4e54adeb70ad87262505ebd28ed297e02d9fd3755f24c06e2bd628dd56b87b80688b7aa8588d35722ab870b2d294e4d79db03a6f2cea1d54d9753f5
SSDEEP 24576:EJbL4+LzoenX+eUX6MB/a9CwCvHqSnxKMBmqPZEN+pj1VoSRbnbfo8EGjMXXLeJv:CLi5jMXXL+acdiIcYaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

raiseversed.dll

Path C:\Users\Admin\AppData\Local\Temp\raiseversed.dll
Size 3.6MB
SHA256 815dcf03581b840e49038cb2d3bbfe6fe6e8a3d154ac361b93cec4abd404de01
MD5 9d11f9931b33a2a7a722a6c945eb844f
SHA1 36b18c79b54b8b0fe2b3db7e98f2ee147317c9ce
SHA512 55b78f03e4e54adeb70ad87262505ebd28ed297e02d9fd3755f24c06e2bd628dd56b87b80688b7aa8588d35722ab870b2d294e4d79db03a6f2cea1d54d9753f5
SSDEEP 24576:EJbL4+LzoenX+eUX6MB/a9CwCvHqSnxKMBmqPZEN+pj1VoSRbnbfo8EGjMXXLeJv:CLi5jMXXL+acdiIcYaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

relationboat.bat

Path C:\Users\Admin\AppData\Local\Temp\relationboat.bat
Size 4.9MB
SHA256 389c5f29a922e6ae38e9d4999b5b8149ad5bdc6378e733fb3581ccc272931e86
MD5 a639233c19489eace132ad82a42df5a4
SHA1 3035708facc5f29c8e7e4e6fe838d4cdf61e5c28
SHA512 50c9e2064461cc8d83bd67c2b79294608aac75f7fea4205227c8ea86e6a4d00bf0d666a5701f8660ab80a168eb3cec58ed16f6424767294e10e1a4aa5ba2b916
SSDEEP 24576:5haPEhagriP3yLbFNa0r0wQ5yzbLZoxE7m98Sn/dD2wxIt2VQi+k7lAcl5C70UVk:DagZgX0n57Yc2GnUbUm
MD5 SHA1 SHA512 SSDEEP

Submit Download

relationboat.bat

Path C:\Users\Admin\AppData\Local\Temp\relationboat.bat
Size 4.9MB
SHA256 389c5f29a922e6ae38e9d4999b5b8149ad5bdc6378e733fb3581ccc272931e86
MD5 a639233c19489eace132ad82a42df5a4
SHA1 3035708facc5f29c8e7e4e6fe838d4cdf61e5c28
SHA512 50c9e2064461cc8d83bd67c2b79294608aac75f7fea4205227c8ea86e6a4d00bf0d666a5701f8660ab80a168eb3cec58ed16f6424767294e10e1a4aa5ba2b916
SSDEEP 24576:5haPEhagriP3yLbFNa0r0wQ5yzbLZoxE7m98Sn/dD2wxIt2VQi+k7lAcl5C70UVk:DagZgX0n57Yc2GnUbUm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3380-8928-0x0000000000E60000-0x0000000000E81000-memory.dmp

Download

memory/3380-8929-0x000000006D7C0000-0x000000006DB64000-memory.dmp

Download

memory/3380-8930-0x0000000000E60000-0x0000000000E81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads