strela | 2be9930bb877b5fa9c31d313c8d240bfe9e3dc07d8a2bf8c80a6aa3f4e95689b

General

Target
DOC_42646715.js
Size 425KB
Sample231108-l5bmdaba26
SHA256 1092804e199e519d11bb9732233b30bff502c8ff6f45a3ef8eadb8bcb925b7f2
MD5 68d83b8158c0322254bb03b8300d5eb1
SHA1 54293154762cdb43cf2dc89453eb7cfae609ff24
SHA512 f102685930f410bfbb6c0f8f7eef730e87fd3306fbb6f06830307d1a9fb4e66da7a794f916c6b7b2e1a267ab84d1a348792ddf8ac24a012e67441fee0040f54b
SSDEEP 6144:BmkOtZkY0eUV9c/U/ITOr4pyCZLquMZcjiVv+1zWi9qgsgUpQ47GKn:IZkY0VV93ITOMcCZLqRajiV1i9xbUl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
3592	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2972	1528	wscript.exe	88
PID 1528 wrote to memory of 2972	1528	wscript.exe	88
PID 2972 wrote to memory of 1952	2972	cmd.exe	91
PID 2972 wrote to memory of 1952	2972	cmd.exe	91
PID 2972 wrote to memory of 2752	2972	cmd.exe	92
PID 2972 wrote to memory of 2752	2972	cmd.exe	92
PID 2972 wrote to memory of 3592	2972	cmd.exe	93
PID 2972 wrote to memory of 3592	2972	cmd.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\DOC_42646715.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\DOC_42646715.js" "C:\Users\Admin\AppData\Local\Temp\\electrictruculentbawdyimportant.bat" && "C:\Users\Admin\AppData\Local\Temp\\electrictruculentbawdyimportant.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\findstr.exe
    findstr /V streamdestructionacidicground ""C:\Users\Admin\AppData\Local\Temp\\electrictruculentbawdyimportant.bat""
    3⤵
    PID:1952
- - C:\Windows\system32\certutil.exe
    certutil -f -decode cynicalclothreasonfar-flung acceptablebumpwrenchwholesale.dll
    3⤵
    PID:2752
- - C:\Windows\system32\regsvr32.exe
    regsvr32 acceptablebumpwrenchwholesale.dll
    3⤵
    - Loads dropped DLL
    PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

acceptablebumpwrenchwholesale.dll

Path C:\Users\Admin\AppData\Local\Temp\acceptablebumpwrenchwholesale.dll
Size 241KB
SHA256 8d6fa1d8dca59b4cfaba002c13a1671d3ce7a03625b74c5357d5c72819187a5f
MD5 058bd6ed3f80da464643e21a635be867
SHA1 8b6166a8e25fdaa0ee03a3dbb359f2874753333c
SHA512 f4aee4510495a00f640efaa4954c06024bbf94f1ab05a898a2701b7596c62fca8a6e721bef7c005ed40a7e8fb4fb79c100425e131bb365fee703c5619b4c0789
SSDEEP 3072:ruWBnVHe5GNlAR+SmzIBRGM+pb2it4vCpK7x5J0+g8ZO9vWB7w0BENqWX0uJIkVf:rXVHKGHzr1puk+g8md0Gpk4IPTKYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

acceptablebumpwrenchwholesale.dll

Path C:\Users\Admin\AppData\Local\Temp\acceptablebumpwrenchwholesale.dll
Size 241KB
SHA256 8d6fa1d8dca59b4cfaba002c13a1671d3ce7a03625b74c5357d5c72819187a5f
MD5 058bd6ed3f80da464643e21a635be867
SHA1 8b6166a8e25fdaa0ee03a3dbb359f2874753333c
SHA512 f4aee4510495a00f640efaa4954c06024bbf94f1ab05a898a2701b7596c62fca8a6e721bef7c005ed40a7e8fb4fb79c100425e131bb365fee703c5619b4c0789
SSDEEP 3072:ruWBnVHe5GNlAR+SmzIBRGM+pb2it4vCpK7x5J0+g8ZO9vWB7w0BENqWX0uJIkVf:rXVHKGHzr1puk+g8md0Gpk4IPTKYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

cynicalclothreasonfar-flung

Path C:\Users\Admin\AppData\Local\Temp\cynicalclothreasonfar-flung
Size 321KB
SHA256 60976fa5e5651b56d38a9e68018e30b6922ecb4d5b1fa42277da03ea0da9c6e6
MD5 60872d327a14680b8e772ce60e5de254
SHA1 d4161d1a27b16f5566f66547ccb5c5ec1b9fdb90
SHA512 072640fb0d69f28af944721038cd620d103802a33f9c85f0d029e8678febf8f67025a1cf384bdcfabf945e45e13a8776b971eef1b357a6ba198679960b13846c
SSDEEP 6144:BmkOtZkY0eUV9c/U/ITOr4pyCZLquMZcjiVvC:IZkY0VV93ITOMcCZLqRajiV6
MD5 SHA1 SHA512 SSDEEP

Submit Download

electrictruculentbawdyimportant.bat

Path C:\Users\Admin\AppData\Local\Temp\electrictruculentbawdyimportant.bat
Size 425KB
SHA256 1092804e199e519d11bb9732233b30bff502c8ff6f45a3ef8eadb8bcb925b7f2
MD5 68d83b8158c0322254bb03b8300d5eb1
SHA1 54293154762cdb43cf2dc89453eb7cfae609ff24
SHA512 f102685930f410bfbb6c0f8f7eef730e87fd3306fbb6f06830307d1a9fb4e66da7a794f916c6b7b2e1a267ab84d1a348792ddf8ac24a012e67441fee0040f54b
SSDEEP 6144:BmkOtZkY0eUV9c/U/ITOr4pyCZLquMZcjiVv+1zWi9qgsgUpQ47GKn:IZkY0VV93ITOMcCZLqRajiV1i9xbUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

electrictruculentbawdyimportant.bat

Path C:\Users\Admin\AppData\Local\Temp\electrictruculentbawdyimportant.bat
Size 425KB
SHA256 1092804e199e519d11bb9732233b30bff502c8ff6f45a3ef8eadb8bcb925b7f2
MD5 68d83b8158c0322254bb03b8300d5eb1
SHA1 54293154762cdb43cf2dc89453eb7cfae609ff24
SHA512 f102685930f410bfbb6c0f8f7eef730e87fd3306fbb6f06830307d1a9fb4e66da7a794f916c6b7b2e1a267ab84d1a348792ddf8ac24a012e67441fee0040f54b
SSDEEP 6144:BmkOtZkY0eUV9c/U/ITOr4pyCZLquMZcjiVv+1zWi9qgsgUpQ47GKn:IZkY0VV93ITOMcCZLqRajiV1i9xbUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3592-227-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3592-228-0x000000006D7C0000-0x000000006D804000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads