strela | 46411e7b8440fe9da300f8185a3243547a942d143fdb6830a5b99069e6a7eb26

General

Target
INVOICE_3270030742.js
Size 533KB
Sample231109-rbfxwsba96
SHA256 9f98dc111fc304893340c85785f74ff70fd00700ff21db044a41153c24bfe759
MD5 1b2885799dfb9e88d81ebef053febd77
SHA1 87dde313af7186a8c24aa38b0e2b4d1ee88a3665
SHA512 7be63b8cc3c648b71cf27321f81a2b0293cd816b76527234254da02943c1fa9f924f1b8bfdf725fe149f40aa078cf6d72e355037e8c3ee1ca98c6911ae123ed3
SSDEEP 12288:M+R/61pwglnd7k0xHkcvtClJoGeMYQEfi9xbUd:MNQchRxHkcoJoXMXEfUbUd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
4372	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3936	3672	wscript.exe	86
PID 3672 wrote to memory of 3936	3672	wscript.exe	86
PID 3936 wrote to memory of 4600	3936	cmd.exe	95
PID 3936 wrote to memory of 4600	3936	cmd.exe	95
PID 3936 wrote to memory of 3340	3936	cmd.exe	96
PID 3936 wrote to memory of 3340	3936	cmd.exe	96
PID 3936 wrote to memory of 4372	3936	cmd.exe	97
PID 3936 wrote to memory of 4372	3936	cmd.exe	97

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\INVOICE_3270030742.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\INVOICE_3270030742.js" "C:\Users\Admin\AppData\Local\Temp\\plastictickpanvigorous.bat" && "C:\Users\Admin\AppData\Local\Temp\\plastictickpanvigorous.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\system32\findstr.exe
    findstr /V countryplayquiversmoggy ""C:\Users\Admin\AppData\Local\Temp\\plastictickpanvigorous.bat""
    3⤵
    PID:4600
- - C:\Windows\system32\certutil.exe
    certutil -f -decode gratisprepareregularspell blacknuttyburlycagey.dll
    3⤵
    PID:3340
- - C:\Windows\system32\regsvr32.exe
    regsvr32 blacknuttyburlycagey.dll
    3⤵
    - Loads dropped DLL
    PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blacknuttyburlycagey.dll

Path C:\Users\Admin\AppData\Local\Temp\blacknuttyburlycagey.dll
Size 324KB
SHA256 8cc7c9e02a22dd7b628a226eb6a4e40ae34fe0ba3b72adeca40b800bd0636436
MD5 6ad37d80d4b5a8a28b10340bf4724991
SHA1 2a05313cd34d28a9bfb4757abe1f02d79f7c1dc2
SHA512 d03fa3eee4ab6fea9eebb52a98667a4338629c11488615981856ef565f2720143151ac51539b07003bfca26d8fea2e93175da5e544a81d348623b390c9cf61c6
SSDEEP 6144:JVk1WtHgT+tQ5GRWojPHXwtsKrpe6DrJhxHO/DvcTKoi:JVQWtHgatKwWWPHxopeQ/B0DvIKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

blacknuttyburlycagey.dll

Path C:\Users\Admin\AppData\Local\Temp\blacknuttyburlycagey.dll
Size 324KB
SHA256 8cc7c9e02a22dd7b628a226eb6a4e40ae34fe0ba3b72adeca40b800bd0636436
MD5 6ad37d80d4b5a8a28b10340bf4724991
SHA1 2a05313cd34d28a9bfb4757abe1f02d79f7c1dc2
SHA512 d03fa3eee4ab6fea9eebb52a98667a4338629c11488615981856ef565f2720143151ac51539b07003bfca26d8fea2e93175da5e544a81d348623b390c9cf61c6
SSDEEP 6144:JVk1WtHgT+tQ5GRWojPHXwtsKrpe6DrJhxHO/DvcTKoi:JVQWtHgatKwWWPHxopeQ/B0DvIKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

gratisprepareregularspell

Path C:\Users\Admin\AppData\Local\Temp\gratisprepareregularspell
Size 433KB
SHA256 6dcbe761b41cb5492bc0cd97e1fb58402939ec19dd3d39fee95e778a611e494f
MD5 efb30e1b5436a83fa6ce9028bdeea423
SHA1 20c58c23f10cde35e5003c4d2ddf3783a2a17da3
SHA512 7f74795708cf0ffc54a56d2bd054436ce6fe73551dbff21f262a562618ee9e33ce7dc152f690cde96a7878287a058c4a4dacefb7b4c09fab16ebac48d20635ba
SSDEEP 6144:XDraF3Vx/6Xn8Mpd60+wlnHLEMaYHbk1mxt5gZ3qlWtmtCR/QqPvYIreMYQEj:z+R/61pwglnd7k0xHkcvtClJoGeMYQEj
MD5 SHA1 SHA512 SSDEEP

Submit Download

plastictickpanvigorous.bat

Path C:\Users\Admin\AppData\Local\Temp\plastictickpanvigorous.bat
Size 533KB
SHA256 9f98dc111fc304893340c85785f74ff70fd00700ff21db044a41153c24bfe759
MD5 1b2885799dfb9e88d81ebef053febd77
SHA1 87dde313af7186a8c24aa38b0e2b4d1ee88a3665
SHA512 7be63b8cc3c648b71cf27321f81a2b0293cd816b76527234254da02943c1fa9f924f1b8bfdf725fe149f40aa078cf6d72e355037e8c3ee1ca98c6911ae123ed3
SSDEEP 12288:M+R/61pwglnd7k0xHkcvtClJoGeMYQEfi9xbUd:MNQchRxHkcoJoXMXEfUbUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

plastictickpanvigorous.bat

Path C:\Users\Admin\AppData\Local\Temp\plastictickpanvigorous.bat
Size 533KB
SHA256 9f98dc111fc304893340c85785f74ff70fd00700ff21db044a41153c24bfe759
MD5 1b2885799dfb9e88d81ebef053febd77
SHA1 87dde313af7186a8c24aa38b0e2b4d1ee88a3665
SHA512 7be63b8cc3c648b71cf27321f81a2b0293cd816b76527234254da02943c1fa9f924f1b8bfdf725fe149f40aa078cf6d72e355037e8c3ee1ca98c6911ae123ed3
SSDEEP 12288:M+R/61pwglnd7k0xHkcvtClJoGeMYQEfi9xbUd:MNQchRxHkcoJoXMXEfUbUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4372-332-0x0000000002C60000-0x0000000002C81000-memory.dmp

Download

memory/4372-333-0x000000006D7C0000-0x000000006D818000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads