strela | d8a6810d529662b18a5e2a3290848ef9f7b91ca302fc0c2f72f0db6ed03c4323

General

Target
DOC_315892419.js
Size 436KB
Sample231121-qe7pcafd6t
SHA256 d8a6810d529662b18a5e2a3290848ef9f7b91ca302fc0c2f72f0db6ed03c4323
MD5 6d00fde575b4cfa03aab318cd45045c2
SHA1 4f6862f3e1b1ea27fbd20182e8270d5de70cc8e0
SHA512 1dd56bc6626cfa8528a64e806a1a23d06ab12b06747de5f0671c9a6bbe65dbf73b85bb0c267f079816ed0a19aaf93555f0f29522c24c6dc8dd238b4f22fba7bf
SSDEEP 12288:PDMInRe7YkYNTmWwP3f64zADl5OyNi9xbUW:PDMie7VHD3f64zADPNUbUW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
2012	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4596	1012	wscript.exe	87
PID 1012 wrote to memory of 4596	1012	wscript.exe	87
PID 4596 wrote to memory of 2484	4596	cmd.exe	90
PID 4596 wrote to memory of 2484	4596	cmd.exe	90
PID 4596 wrote to memory of 4240	4596	cmd.exe	91
PID 4596 wrote to memory of 4240	4596	cmd.exe	91
PID 4596 wrote to memory of 2012	4596	cmd.exe	92
PID 4596 wrote to memory of 2012	4596	cmd.exe	92

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\DOC_315892419.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\DOC_315892419.js" "C:\Users\Admin\AppData\Local\Temp\\possessinformexcusesort.bat" && "C:\Users\Admin\AppData\Local\Temp\\possessinformexcusesort.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\findstr.exe
    findstr /V bladeshrillflamefront ""C:\Users\Admin\AppData\Local\Temp\\possessinformexcusesort.bat""
    3⤵
    PID:2484
- - C:\Windows\system32\certutil.exe
    certutil -f -decode wearymoneyclaimexpect suspectcreamtearfultravel.dll
    3⤵
    PID:4240
- - C:\Windows\system32\regsvr32.exe
    regsvr32 suspectcreamtearfultravel.dll
    3⤵
    - Loads dropped DLL
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

possessinformexcusesort.bat

Path C:\Users\Admin\AppData\Local\Temp\possessinformexcusesort.bat
Size 436KB
SHA256 d8a6810d529662b18a5e2a3290848ef9f7b91ca302fc0c2f72f0db6ed03c4323
MD5 6d00fde575b4cfa03aab318cd45045c2
SHA1 4f6862f3e1b1ea27fbd20182e8270d5de70cc8e0
SHA512 1dd56bc6626cfa8528a64e806a1a23d06ab12b06747de5f0671c9a6bbe65dbf73b85bb0c267f079816ed0a19aaf93555f0f29522c24c6dc8dd238b4f22fba7bf
SSDEEP 12288:PDMInRe7YkYNTmWwP3f64zADl5OyNi9xbUW:PDMie7VHD3f64zADPNUbUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

possessinformexcusesort.bat

Path C:\Users\Admin\AppData\Local\Temp\possessinformexcusesort.bat
Size 436KB
SHA256 d8a6810d529662b18a5e2a3290848ef9f7b91ca302fc0c2f72f0db6ed03c4323
MD5 6d00fde575b4cfa03aab318cd45045c2
SHA1 4f6862f3e1b1ea27fbd20182e8270d5de70cc8e0
SHA512 1dd56bc6626cfa8528a64e806a1a23d06ab12b06747de5f0671c9a6bbe65dbf73b85bb0c267f079816ed0a19aaf93555f0f29522c24c6dc8dd238b4f22fba7bf
SSDEEP 12288:PDMInRe7YkYNTmWwP3f64zADl5OyNi9xbUW:PDMie7VHD3f64zADPNUbUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

suspectcreamtearfultravel.dll

Path C:\Users\Admin\AppData\Local\Temp\suspectcreamtearfultravel.dll
Size 252KB
SHA256 e0239eb26737fd8872dacd4e5b4e65c0447082417820cad3f43c53fd935a3e0c
MD5 ef99810dc1e19764f71ece873e1fa8dd
SHA1 6ff65e0d491c350f5e1978b723e520121285aec4
SHA512 ed138540bb64a987af7ee54650eb39548017db9f480a326a18739c777a825968086b01ae189a0147f9f799da4cc88232177d6e74146ef9c4653cca704c8f8e4b
SSDEEP 3072:3BqMzbkczFZXYrCfceAID4uvFANZOm1ZRXqX1hSjM9iGEANbvpLcwY6ZU2NSps+9:/VD0OtvOMJEANbxLcmZg4mij2euTKj2
MD5 SHA1 SHA512 SSDEEP

Submit Download

suspectcreamtearfultravel.dll

Path C:\Users\Admin\AppData\Local\Temp\suspectcreamtearfultravel.dll
Size 252KB
SHA256 e0239eb26737fd8872dacd4e5b4e65c0447082417820cad3f43c53fd935a3e0c
MD5 ef99810dc1e19764f71ece873e1fa8dd
SHA1 6ff65e0d491c350f5e1978b723e520121285aec4
SHA512 ed138540bb64a987af7ee54650eb39548017db9f480a326a18739c777a825968086b01ae189a0147f9f799da4cc88232177d6e74146ef9c4653cca704c8f8e4b
SSDEEP 3072:3BqMzbkczFZXYrCfceAID4uvFANZOm1ZRXqX1hSjM9iGEANbvpLcwY6ZU2NSps+9:/VD0OtvOMJEANbxLcmZg4mij2euTKj2
MD5 SHA1 SHA512 SSDEEP

Submit Download

wearymoneyclaimexpect

Path C:\Users\Admin\AppData\Local\Temp\wearymoneyclaimexpect
Size 336KB
SHA256 53ce9ba67b55ffee8292eeabcac6cf2b37c33433988ca47935a31d9899f5de3a
MD5 fec594ce522f3cbff8daa9f361c6e94a
SHA1 6eed638a79ff9f3ec78499fcda657b4fadb88595
SHA512 c748a93500730bafe72fcbea99e95dfe458c9a56b1235a92d024f36568c3d731122543f59b2378db4464771bfab075224c767d7f42934e842d8e651e3dde90be
SSDEEP 6144:MDMIwivZMr7YIhYo0TP+WRwpl3MCr67EyM6ZvrlOoOym:MDMInRe7YkYNTmWwP3f64zADl5Oym
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2012-270-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/2012-271-0x000000006D7C0000-0x000000006D807000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads