strela | e896bbf849048589fe0b467dfef4e2803e46bcec51f6b91a5c402452653e581c

General

Target
316801558730488.js
Size 1.3MB
Sample231112-txc48shd68
SHA256 e896bbf849048589fe0b467dfef4e2803e46bcec51f6b91a5c402452653e581c
MD5 426e5432490b51f9ce47ef73461da902
SHA1 c00b81f75376fe06534e3edd970c1da12a5f53b8
SHA512 56051d89c9502143fe836333f4a198bdc383a77af706eba562930d3e74869c599d7dddf360aaeabc5a6cef5eef723185e2f8339d26fc080dca38b0af83716298
SSDEEP 12288:OpgX7mD2xSfbnWhPXcFaXySa0OUKS17e8tSBBHGIceTUOI4xTIUG8JzsIO9fuHVn:Oy/9wOfv5Zcy4GdAPx5RUbUB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
432	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2984	772	wscript.exe	86
PID 772 wrote to memory of 2984	772	wscript.exe	86
PID 2984 wrote to memory of 3924	2984	cmd.exe	98
PID 2984 wrote to memory of 3924	2984	cmd.exe	98
PID 2984 wrote to memory of 3728	2984	cmd.exe	99
PID 2984 wrote to memory of 3728	2984	cmd.exe	99
PID 2984 wrote to memory of 432	2984	cmd.exe	100
PID 2984 wrote to memory of 432	2984	cmd.exe	100

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\316801558730488.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\316801558730488.js" "C:\Users\Admin\AppData\Local\Temp\\detectmintauspiciousleather.bat" && "C:\Users\Admin\AppData\Local\Temp\\detectmintauspiciousleather.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\findstr.exe
    findstr /V wholesaleshockrailmurder ""C:\Users\Admin\AppData\Local\Temp\\detectmintauspiciousleather.bat""
    3⤵
    PID:3924
- - C:\Windows\system32\certutil.exe
    certutil -f -decode flavorknottystimulatingobeisant motionlessroofeducationgroup.dll
    3⤵
    PID:3728
- - C:\Windows\system32\regsvr32.exe
    regsvr32 motionlessroofeducationgroup.dll
    3⤵
    - Loads dropped DLL
    PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

detectmintauspiciousleather.bat

Path C:\Users\Admin\AppData\Local\Temp\detectmintauspiciousleather.bat
Size 1.3MB
SHA256 e896bbf849048589fe0b467dfef4e2803e46bcec51f6b91a5c402452653e581c
MD5 426e5432490b51f9ce47ef73461da902
SHA1 c00b81f75376fe06534e3edd970c1da12a5f53b8
SHA512 56051d89c9502143fe836333f4a198bdc383a77af706eba562930d3e74869c599d7dddf360aaeabc5a6cef5eef723185e2f8339d26fc080dca38b0af83716298
SSDEEP 12288:OpgX7mD2xSfbnWhPXcFaXySa0OUKS17e8tSBBHGIceTUOI4xTIUG8JzsIO9fuHVn:Oy/9wOfv5Zcy4GdAPx5RUbUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

detectmintauspiciousleather.bat

Path C:\Users\Admin\AppData\Local\Temp\detectmintauspiciousleather.bat
Size 1.3MB
SHA256 e896bbf849048589fe0b467dfef4e2803e46bcec51f6b91a5c402452653e581c
MD5 426e5432490b51f9ce47ef73461da902
SHA1 c00b81f75376fe06534e3edd970c1da12a5f53b8
SHA512 56051d89c9502143fe836333f4a198bdc383a77af706eba562930d3e74869c599d7dddf360aaeabc5a6cef5eef723185e2f8339d26fc080dca38b0af83716298
SSDEEP 12288:OpgX7mD2xSfbnWhPXcFaXySa0OUKS17e8tSBBHGIceTUOI4xTIUG8JzsIO9fuHVn:Oy/9wOfv5Zcy4GdAPx5RUbUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

flavorknottystimulatingobeisant

Path C:\Users\Admin\AppData\Local\Temp\flavorknottystimulatingobeisant
Size 1.2MB
SHA256 6a0a8079c011cb8ceca4ebe9373a569cfd8fc2b504a2c7357a477f489e3f3548
MD5 dc722c34372f37dd63aba6d0353c0618
SHA1 757feb33e9107fd938d19767b262d88361f3ad16
SHA512 fc9ff666aa2895ed88b4ed1bd32116b1e953108a572eb00c6de264ff0b5814becc392ffb14397a4f62eec8eab314a5e2c663305e6c26044b0ab8043c70c9d847
SSDEEP 12288:QpgX7mD2xSfbnWhPXcFaXySa0OUKS17e8tSBBHGIceTUOI4xTIUG8JzsIO9fuHVj:Qy/9wOfv5Zcy4GdAPx5j
MD5 SHA1 SHA512 SSDEEP

Submit Download

motionlessroofeducationgroup.dll

Path C:\Users\Admin\AppData\Local\Temp\motionlessroofeducationgroup.dll
Size 937KB
SHA256 10069561921b8fa154124a034ab6efabc4db1433a68bacfef9bc6b7f41251877
MD5 827de069fa507cc64621444424d42ee4
SHA1 d40266223cfa75d0c528ce03ffb7be2fdb332730
SHA512 9b908c5cd8948f136085d30de5432dc36bd73a0c2ca1ac546f160c96519a542fe0c7201f9aa86a941d13b2c2eff21e8669541d237cdf223ce16cb6a1b5803304
SSDEEP 12288:Iudl3wsWynCwwNAoRx09jSfqnKAVOVJkMZJXEg4ta2eCyU4AIbPN+1ArDCKH:bFCLNWTVOrkiXD2ePbh+ADB
MD5 SHA1 SHA512 SSDEEP

Submit Download

motionlessroofeducationgroup.dll

Path C:\Users\Admin\AppData\Local\Temp\motionlessroofeducationgroup.dll
Size 937KB
SHA256 10069561921b8fa154124a034ab6efabc4db1433a68bacfef9bc6b7f41251877
MD5 827de069fa507cc64621444424d42ee4
SHA1 d40266223cfa75d0c528ce03ffb7be2fdb332730
SHA512 9b908c5cd8948f136085d30de5432dc36bd73a0c2ca1ac546f160c96519a542fe0c7201f9aa86a941d13b2c2eff21e8669541d237cdf223ce16cb6a1b5803304
SSDEEP 12288:Iudl3wsWynCwwNAoRx09jSfqnKAVOVJkMZJXEg4ta2eCyU4AIbPN+1ArDCKH:bFCLNWTVOrkiXD2ePbh+ADB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-845-0x0000000003890000-0x00000000038B1000-memory.dmp

Download

memory/432-846-0x000000006D7C0000-0x000000006D8B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads