strela | 786fc6cdfdd0dcae3e1f1641c28fa8f0474b9016a0ffd82d42f23d214f837efd

General

Target
24493246931877.js
Size 1.3MB
Sample231112-kfw2caec78
SHA256 786fc6cdfdd0dcae3e1f1641c28fa8f0474b9016a0ffd82d42f23d214f837efd
MD5 fdda931653ce8bad08dd9160c32f6900
SHA1 784bf81746e83c49ea75fbb5978fafae3c6b3245
SHA512 3b5336c71307a18d340c8b5b7e0c6d3a1c4ad801715b4d202b8bedb61462028d2a584318996d16f9b742338c0ce883d0fe2d0ab526d2f314796f3c0ddbaf0d59
SSDEEP 12288:+JJFpH1MWiEpIzD7Wwndqw9tEbME7y3IgVjnHdE2Zv/ukqmSVelQJnrSe5JFd4OS:+HVM993s7y3Igbltd/S3sPvyBPwUbU5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
4776	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3712	4568	wscript.exe	87
PID 4568 wrote to memory of 3712	4568	wscript.exe	87
PID 3712 wrote to memory of 3172	3712	cmd.exe	95
PID 3712 wrote to memory of 3172	3712	cmd.exe	95
PID 3712 wrote to memory of 4744	3712	cmd.exe	96
PID 3712 wrote to memory of 4744	3712	cmd.exe	96
PID 3712 wrote to memory of 4776	3712	cmd.exe	97
PID 3712 wrote to memory of 4776	3712	cmd.exe	97

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\24493246931877.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\24493246931877.js" "C:\Users\Admin\AppData\Local\Temp\\signalbirdsskillfuldistribution.bat" && "C:\Users\Admin\AppData\Local\Temp\\signalbirdsskillfuldistribution.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\system32\findstr.exe
    findstr /V pinballwaggishwholesale ""C:\Users\Admin\AppData\Local\Temp\\signalbirdsskillfuldistribution.bat""
    3⤵
    PID:3172
- - C:\Windows\system32\certutil.exe
    certutil -f -decode latehighshakyheady onerousrulescatterstupid.dll
    3⤵
    PID:4744
- - C:\Windows\system32\regsvr32.exe
    regsvr32 onerousrulescatterstupid.dll
    3⤵
    - Loads dropped DLL
    PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

latehighshakyheady

Path C:\Users\Admin\AppData\Local\Temp\latehighshakyheady
Size 1.2MB
SHA256 049ccd1d66a5361830b8ab7ef6272d20925839615e9155495122de1e4c0ec5b4
MD5 c869c4bbcaba146a187553b0ddd12f8b
SHA1 a1b5a24f6b141be3c0e0e1f57f793583a8bf70fa
SHA512 7d75cc01a4180a48118637e80ac24633efb55b5b50213ba98fdbd394e82c44fd3f6f3ddec160ce1b0ed0c93a105331c4b8957c35f4d971773af7ff723d5e03bb
SSDEEP 12288:8JJFpH1MWiEpIzD7Wwndqw9tEbME7y3IgVjnHdE2Zv/ukqmSVelQJnrSe5JFd4OU:8HVM993s7y3Igbltd/S3sPvyBP+
MD5 SHA1 SHA512 SSDEEP

Submit Download

onerousrulescatterstupid.dll

Path C:\Users\Admin\AppData\Local\Temp\onerousrulescatterstupid.dll
Size 914KB
SHA256 98f55205df04470cb742dca99b092cf577cd2576b55390af321553496e5d2ed1
MD5 9e9104fac45a0238aabf770e9d5b115a
SHA1 d9e3dd08d77a99d3e54c11079c9fc0430f752fda
SHA512 3e9e167b452ea62dabc31cda276d6ddc24551ee0b0dbcada66339bab17f6d5ab3f5d015da307432a586a7734b083ef902cc21cec6af54f69005d4b9e0965fdcf
SSDEEP 12288:t8a+LdHxdFIBpCQ+4F3Grn1AK6Tc1RbrRcdcjAKcDGh1Yjk8M7TZYK6:t8a670W4BGrnSnTG1r03KcDK1YJM7TZa
MD5 SHA1 SHA512 SSDEEP

Submit Download

onerousrulescatterstupid.dll

Path C:\Users\Admin\AppData\Local\Temp\onerousrulescatterstupid.dll
Size 914KB
SHA256 98f55205df04470cb742dca99b092cf577cd2576b55390af321553496e5d2ed1
MD5 9e9104fac45a0238aabf770e9d5b115a
SHA1 d9e3dd08d77a99d3e54c11079c9fc0430f752fda
SHA512 3e9e167b452ea62dabc31cda276d6ddc24551ee0b0dbcada66339bab17f6d5ab3f5d015da307432a586a7734b083ef902cc21cec6af54f69005d4b9e0965fdcf
SSDEEP 12288:t8a+LdHxdFIBpCQ+4F3Grn1AK6Tc1RbrRcdcjAKcDGh1Yjk8M7TZYK6:t8a670W4BGrnSnTG1r03KcDK1YJM7TZa
MD5 SHA1 SHA512 SSDEEP

Submit Download

signalbirdsskillfuldistribution.bat

Path C:\Users\Admin\AppData\Local\Temp\signalbirdsskillfuldistribution.bat
Size 1.3MB
SHA256 786fc6cdfdd0dcae3e1f1641c28fa8f0474b9016a0ffd82d42f23d214f837efd
MD5 fdda931653ce8bad08dd9160c32f6900
SHA1 784bf81746e83c49ea75fbb5978fafae3c6b3245
SHA512 3b5336c71307a18d340c8b5b7e0c6d3a1c4ad801715b4d202b8bedb61462028d2a584318996d16f9b742338c0ce883d0fe2d0ab526d2f314796f3c0ddbaf0d59
SSDEEP 12288:+JJFpH1MWiEpIzD7Wwndqw9tEbME7y3IgVjnHdE2Zv/ukqmSVelQJnrSe5JFd4OS:+HVM993s7y3Igbltd/S3sPvyBPwUbU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

signalbirdsskillfuldistribution.bat

Path C:\Users\Admin\AppData\Local\Temp\signalbirdsskillfuldistribution.bat
Size 1.3MB
SHA256 786fc6cdfdd0dcae3e1f1641c28fa8f0474b9016a0ffd82d42f23d214f837efd
MD5 fdda931653ce8bad08dd9160c32f6900
SHA1 784bf81746e83c49ea75fbb5978fafae3c6b3245
SHA512 3b5336c71307a18d340c8b5b7e0c6d3a1c4ad801715b4d202b8bedb61462028d2a584318996d16f9b742338c0ce883d0fe2d0ab526d2f314796f3c0ddbaf0d59
SSDEEP 12288:+JJFpH1MWiEpIzD7Wwndqw9tEbME7y3IgVjnHdE2Zv/ukqmSVelQJnrSe5JFd4OS:+HVM993s7y3Igbltd/S3sPvyBPwUbU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4776-690-0x000000006D7C0000-0x000000006D8AC000-memory.dmp

Download

memory/4776-691-0x00000000050F0000-0x0000000005111000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads