strela | 1f27faa78aef8b8e29cb4b68ba0e6e386f91cdb68975b07fe4486a7d6b853f54

Analysis

max time kernel
135s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2023, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac47215a8231818e4c424012c1527a3e70087739865b035be9b47fb75d34c030.bat
Size 713KB
Sample231126-cczn3aec35
SHA256 ac47215a8231818e4c424012c1527a3e70087739865b035be9b47fb75d34c030
MD5 bc9ae5fde063670508888399f65b2fee
SHA1 8f86773a0da30ccb9e8ba9090a6a405d9a73c510
SHA512 922732a178c5c61e00d50702c9d2df52a946f113878947220ae26db2954475acdd475791b58b0f0b79a50c14ed539d0f3e0d447f9c041b6802a6a1f821fcba47
SSDEEP 12288:O7oh5QoNGWGZyTPnjAmM9aZKTz1RpxFg+cO6lKc9NTu7i8AO7QXM3us4PXc:O7oh5QKGWG0rboasThRpxr56si854Pc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

91.215.85.209

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Loads dropped DLL 1 IoCs

pid	Process
3260	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2496	3192	cmd.exe	85
PID 3192 wrote to memory of 2496	3192	cmd.exe	85
PID 3192 wrote to memory of 1140	3192	cmd.exe	91
PID 3192 wrote to memory of 1140	3192	cmd.exe	91
PID 3192 wrote to memory of 3260	3192	cmd.exe	92
PID 3192 wrote to memory of 3260	3192	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ac47215a8231818e4c424012c1527a3e70087739865b035be9b47fb75d34c030.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\system32\findstr.exe
  findstr /V ambitious "C:\Users\Admin\AppData\Local\Temp\ac47215a8231818e4c424012c1527a3e70087739865b035be9b47fb75d34c030.bat"
  2⤵
  PID:2496
- C:\Windows\system32\certutil.exe
  certutil -f -decode hellish therapeutic.dll
  2⤵
  PID:1140
- C:\Windows\system32\rundll32.exe
  rundll32 therapeutic.dll,x
  2⤵
  - Loads dropped DLL
  PID:3260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

hellish

Path C:\Users\Admin\AppData\Local\Temp\hellish
Size 706KB
SHA256 338dcbd0f75abd063e351bf27c13255ec0f776964ccb7c148ec46806c158ec2e
MD5 c9c89a47c7d937ec0f26092dd8427b70
SHA1 69b578f01b7386be72d7cafcb45bda823fe29a97
SHA512 3300a7822ea99d5ce8d2b28108eaea4af1d2ecacaa5fceae9fb691531a1f8ad803010c10d2dc2bee36ea922d284a18b3c169d350241a5106e2e814fb9a58b4e5
SSDEEP 12288:Y7oh5QoNGWGZyTPnjAmM9aZKTz1RpxFg+cO6lKc9NTu7i8AO7QXM3us4PXK:Y7oh5QKGWG0rboasThRpxr56si854PK
MD5 SHA1 SHA512 SSDEEP

Submit Download

therapeutic.dll

Path C:\Users\Admin\AppData\Local\Temp\therapeutic.dll
Size 527KB
SHA256 efd7a52121867b0d7a60b0fd609fc47726002033662736d309a1b94aa857fb98
MD5 19808287dd44452a6da3596468487675
SHA1 d485f9eaafe0bf0cf7eb77173e6050b54ba05611
SHA512 2863bb7687a08ad36e8642fc6fdd4a4a9822d24a1d91da4a0ac19389c1e6acbedad23a803a497dc1c91baef6e19a4dbb4b4108007a5e2a88ffdc81047dfe2751
SSDEEP 6144:ERSCSg+gfUYRjOuVZFGNRwND7Pypwwf/43wWPpoApvmJraTKzv:ExN21wwCwTA8rSKD
MD5 SHA1 SHA512 SSDEEP

Submit Download

therapeutic.dll

Path C:\Users\Admin\AppData\Local\Temp\therapeutic.dll
Size 527KB
SHA256 efd7a52121867b0d7a60b0fd609fc47726002033662736d309a1b94aa857fb98
MD5 19808287dd44452a6da3596468487675
SHA1 d485f9eaafe0bf0cf7eb77173e6050b54ba05611
SHA512 2863bb7687a08ad36e8642fc6fdd4a4a9822d24a1d91da4a0ac19389c1e6acbedad23a803a497dc1c91baef6e19a4dbb4b4108007a5e2a88ffdc81047dfe2751
SSDEEP 6144:ERSCSg+gfUYRjOuVZFGNRwND7Pypwwf/43wWPpoApvmJraTKzv:ExN21wwCwTA8rSKD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3260-5-0x000000006D7C0000-0x000000006D84C000-memory.dmp

Download

memory/3260-6-0x0000026E4A090000-0x0000026E4A0B1000-memory.dmp

Download

memory/3260-7-0x0000026E4A090000-0x0000026E4A0B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads