Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    26/10/2023, 11:37

General

  • Target

    FACTURA_210231068.js

  • Size

    3.8MB

  • MD5

    23937572ef129eea43b202d55ae55889

  • SHA1

    b9e0d1d51731669022536a43d78cdc3c9c8ab524

  • SHA256

    7842c673ba3e2000971d43f01b5000f71096822696913ead5f863c00b54480ae

  • SHA512

    dc6854379bceb9bdeff73a0bea32e899799deb22d380e243dbf464fbd30cdb2282d6fef729efb28dd8ffb846fa5190d9e716320d890d3a632f875913bf824aa1

  • SSDEEP

    24576:Pojl7Rypzd5obrKfYIqRQ9UqW+b6ViCPyI5+Pb5FUlqoudhTMk+NM8FU1ZXxDbUM:xCCwiUyI5gDTxUbUF

Score
10/10

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

  • Strela

    An info stealer targeting mail credentials first seen in late 2022.

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\FACTURA_210231068.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\FACTURA_210231068.js" "C:\Users\Admin\AppData\Local\Temp\\farmtickle.bat" && "C:\Users\Admin\AppData\Local\Temp\\farmtickle.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Windows\system32\findstr.exe
        findstr /V filthydam ""C:\Users\Admin\AppData\Local\Temp\\farmtickle.bat""
        3⤵
          PID:1672
        • C:\Windows\system32\certutil.exe
          certutil -f -decode developback committeelunchroom.dll
          3⤵
            PID:2560
          • C:\Windows\system32\regsvr32.exe
            regsvr32 committeelunchroom.dll
            3⤵
            • Loads dropped DLL
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:1088

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\committeelunchroom.dll

        Filesize

        2.8MB

        MD5

        e25ee77124ff26a5167d28fd3c6493f7

        SHA1

        1c40976c6950009eb4d36dd15799e973409e9639

        SHA256

        85c253acd652e6ceabcb0dc0fb1341f3251b41707cbc71e517c7a342d9780d43

        SHA512

        6c15f22b36e66d1e92069053a62f826bf87aca0233bcdd1ff90730c3f8e65222b5be3eb8b558fb4bf91bb2e985e1aea0a1ce2da0cd087bff54363768f7bc8e98

      • C:\Users\Admin\AppData\Local\Temp\developback

        Filesize

        3.7MB

        MD5

        6ee4d167b37fd33367f52f69940fac3e

        SHA1

        53399ce699eab939e374ffae539910a9c1727d0f

        SHA256

        57ef19edd0b8456a464e6e9428fa4d966145f15b626f230be5dd083c79c8efe0

        SHA512

        6557e323c054bf8022e170aa8ad0e9c1b374a4cd32085321767e790a97203bc5b568f0df759c140e1d74aa16db9ab76d997007c94614973e5e1a33c03abe69b6

      • C:\Users\Admin\AppData\Local\Temp\farmtickle.bat

        Filesize

        3.8MB

        MD5

        23937572ef129eea43b202d55ae55889

        SHA1

        b9e0d1d51731669022536a43d78cdc3c9c8ab524

        SHA256

        7842c673ba3e2000971d43f01b5000f71096822696913ead5f863c00b54480ae

        SHA512

        dc6854379bceb9bdeff73a0bea32e899799deb22d380e243dbf464fbd30cdb2282d6fef729efb28dd8ffb846fa5190d9e716320d890d3a632f875913bf824aa1

      • C:\Users\Admin\AppData\Local\Temp\farmtickle.bat

        Filesize

        3.8MB

        MD5

        23937572ef129eea43b202d55ae55889

        SHA1

        b9e0d1d51731669022536a43d78cdc3c9c8ab524

        SHA256

        7842c673ba3e2000971d43f01b5000f71096822696913ead5f863c00b54480ae

        SHA512

        dc6854379bceb9bdeff73a0bea32e899799deb22d380e243dbf464fbd30cdb2282d6fef729efb28dd8ffb846fa5190d9e716320d890d3a632f875913bf824aa1

      • \Users\Admin\AppData\Local\Temp\committeelunchroom.dll

        Filesize

        2.8MB

        MD5

        e25ee77124ff26a5167d28fd3c6493f7

        SHA1

        1c40976c6950009eb4d36dd15799e973409e9639

        SHA256

        85c253acd652e6ceabcb0dc0fb1341f3251b41707cbc71e517c7a342d9780d43

        SHA512

        6c15f22b36e66d1e92069053a62f826bf87aca0233bcdd1ff90730c3f8e65222b5be3eb8b558fb4bf91bb2e985e1aea0a1ce2da0cd087bff54363768f7bc8e98

      • memory/1088-4956-0x000000006D7C0000-0x000000006DA92000-memory.dmp

        Filesize

        2.8MB

      • memory/1088-4955-0x00000000001B0000-0x00000000001D1000-memory.dmp

        Filesize

        132KB

      • memory/1088-4957-0x00000000001B0000-0x00000000001D1000-memory.dmp

        Filesize

        132KB