Analysis
- max time kernel
108s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
13/11/2023, 03:30
General
- Target NEAS.d72444ba31f9ef939bb9da4912f92060.dll
- Size 316KB
- Sample231113-d2xrfage3s
- SHA256 b2e82711701fd83763edf99473e14a34110ec1d598e8cf550a82ea627ac7fab4
Malware Config
Extracted
-
strela
-
193.109.85.77
Signatures
- Strela
An info stealer targeting mail credentials first seen in late 2022.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.d72444ba31f9ef939bb9da4912f92060.dll1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1044-42-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-67-0x000001BA2B370000-0x000001BA2B371000-memory.dmp
memory/1044-71-0x000001BA2B490000-0x000001BA2B491000-memory.dmp
memory/1044-3-0x000001BA22F40000-0x000001BA22F50000-memory.dmp
memory/1044-19-0x000001BA23040000-0x000001BA23050000-memory.dmp
memory/1044-35-0x000001BA2B5F0000-0x000001BA2B5F1000-memory.dmp
memory/1044-36-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-37-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-38-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-39-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-40-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-41-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-70-0x000001BA2B380000-0x000001BA2B381000-memory.dmp
memory/1044-44-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-69-0x000001BA2B380000-0x000001BA2B381000-memory.dmp
memory/1044-45-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/1044-46-0x000001BA2B240000-0x000001BA2B241000-memory.dmp
memory/1044-47-0x000001BA2B230000-0x000001BA2B231000-memory.dmp
memory/1044-49-0x000001BA2B240000-0x000001BA2B241000-memory.dmp
memory/1044-52-0x000001BA2B230000-0x000001BA2B231000-memory.dmp
memory/1044-55-0x000001BA2B170000-0x000001BA2B171000-memory.dmp
memory/1044-43-0x000001BA2B610000-0x000001BA2B611000-memory.dmp
memory/3148-0-0x000000006D7C0000-0x000000006D816000-memory.dmp
memory/3148-1-0x00000000026B0000-0x00000000026D1000-memory.dmp
memory/3148-2-0x00000000026B0000-0x00000000026D1000-memory.dmp