strela | 15cacb4f952177a2bbe3834a8c2217aa6ef5b78a8cd8af42ada9ff5a992292fc

General

Target
11074822014705.js
Size 6.5MB
Sample231126-w6mfdaba5v
SHA256 15cacb4f952177a2bbe3834a8c2217aa6ef5b78a8cd8af42ada9ff5a992292fc
MD5 8e75c8837c8288c2abd1c4ae364bb553
SHA1 5cf4550318b5f2eaca312149f06f5872f531785a
SHA512 1a7cacdeca0fbc0115674e41ce4ed68051c706928a2ee87121218908af2e9bbf01c7f3bce12f9facaf98a9b0a86a10f8f6e51cd073ff346ccda3c0e020275aa1
SSDEEP 24576:aM28t5oydiys4k1XWk6uyBWXJCirWqXNGLH5HvuVLptpWqm6xVowk8dppKEvzVBi:Ns47TiwQ5x2uA1Y0fm1nmlUiUbUN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
952	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1668	1816	wscript.exe	85
PID 1816 wrote to memory of 1668	1816	wscript.exe	85
PID 1668 wrote to memory of 5088	1668	cmd.exe	95
PID 1668 wrote to memory of 5088	1668	cmd.exe	95
PID 1668 wrote to memory of 4528	1668	cmd.exe	96
PID 1668 wrote to memory of 4528	1668	cmd.exe	96
PID 1668 wrote to memory of 952	1668	cmd.exe	97
PID 1668 wrote to memory of 952	1668	cmd.exe	97

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\11074822014705.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\11074822014705.js" "C:\Users\Admin\AppData\Local\Temp\\smoggywhiteoddelectric.bat" && "C:\Users\Admin\AppData\Local\Temp\\smoggywhiteoddelectric.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\findstr.exe
    findstr /V amusescintillatingthunderingdeadpan ""C:\Users\Admin\AppData\Local\Temp\\smoggywhiteoddelectric.bat""
    3⤵
    PID:5088
- - C:\Windows\system32\certutil.exe
    certutil -f -decode trueterrificdebonairfireman harassbegabhorrentnotice.dll
    3⤵
    PID:4528
- - C:\Windows\system32\regsvr32.exe
    regsvr32 harassbegabhorrentnotice.dll
    3⤵
    - Loads dropped DLL
    PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

harassbegabhorrentnotice.dll

Path C:\Users\Admin\AppData\Local\Temp\harassbegabhorrentnotice.dll
Size 4.8MB
SHA256 3efc0fc3ce934509a40e83f2414bcc2708b5c111a1ddb2441f3704243fb4e2dc
MD5 384dac3b43bea5b51b862675b3f46cad
SHA1 0ff5b5440e2fee3b5846c887d38560fc9e99bb00
SHA512 cdbf723866cc2aee637f840e351493a839a9614c7f4f6b1740ae8ee5aa676c76c5093085ff57c101188e48a2ca4480ee6ed6f6285fe9de43b0a9e6df77f154c2
SSDEEP 24576:Dp3jZMyDm0aGexI0mwIyahAt8HkpIIsZ3/8BlNUaRXV06JaOrrc9uaRgtVD55381:lTTF8vnwC5yKGZvDUVpMmF/2Wy
MD5 SHA1 SHA512 SSDEEP

Submit Download

harassbegabhorrentnotice.dll

Path C:\Users\Admin\AppData\Local\Temp\harassbegabhorrentnotice.dll
Size 4.8MB
SHA256 3efc0fc3ce934509a40e83f2414bcc2708b5c111a1ddb2441f3704243fb4e2dc
MD5 384dac3b43bea5b51b862675b3f46cad
SHA1 0ff5b5440e2fee3b5846c887d38560fc9e99bb00
SHA512 cdbf723866cc2aee637f840e351493a839a9614c7f4f6b1740ae8ee5aa676c76c5093085ff57c101188e48a2ca4480ee6ed6f6285fe9de43b0a9e6df77f154c2
SSDEEP 24576:Dp3jZMyDm0aGexI0mwIyahAt8HkpIIsZ3/8BlNUaRXV06JaOrrc9uaRgtVD55381:lTTF8vnwC5yKGZvDUVpMmF/2Wy
MD5 SHA1 SHA512 SSDEEP

Submit Download

smoggywhiteoddelectric.bat

Path C:\Users\Admin\AppData\Local\Temp\smoggywhiteoddelectric.bat
Size 6.5MB
SHA256 15cacb4f952177a2bbe3834a8c2217aa6ef5b78a8cd8af42ada9ff5a992292fc
MD5 8e75c8837c8288c2abd1c4ae364bb553
SHA1 5cf4550318b5f2eaca312149f06f5872f531785a
SHA512 1a7cacdeca0fbc0115674e41ce4ed68051c706928a2ee87121218908af2e9bbf01c7f3bce12f9facaf98a9b0a86a10f8f6e51cd073ff346ccda3c0e020275aa1
SSDEEP 24576:aM28t5oydiys4k1XWk6uyBWXJCirWqXNGLH5HvuVLptpWqm6xVowk8dppKEvzVBi:Ns47TiwQ5x2uA1Y0fm1nmlUiUbUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

smoggywhiteoddelectric.bat

Path C:\Users\Admin\AppData\Local\Temp\smoggywhiteoddelectric.bat
Size 6.5MB
SHA256 15cacb4f952177a2bbe3834a8c2217aa6ef5b78a8cd8af42ada9ff5a992292fc
MD5 8e75c8837c8288c2abd1c4ae364bb553
SHA1 5cf4550318b5f2eaca312149f06f5872f531785a
SHA512 1a7cacdeca0fbc0115674e41ce4ed68051c706928a2ee87121218908af2e9bbf01c7f3bce12f9facaf98a9b0a86a10f8f6e51cd073ff346ccda3c0e020275aa1
SSDEEP 24576:aM28t5oydiys4k1XWk6uyBWXJCirWqXNGLH5HvuVLptpWqm6xVowk8dppKEvzVBi:Ns47TiwQ5x2uA1Y0fm1nmlUiUbUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

trueterrificdebonairfireman

Path C:\Users\Admin\AppData\Local\Temp\trueterrificdebonairfireman
Size 6.4MB
SHA256 2347fe92811a8952b8783b2419872500f08060a58bb2415429f802044233da0b
MD5 987844df8910f57e337f9309419d3998
SHA1 f95606120a8cdd0305d889df88a128d4d396824d
SHA512 a72383aa46bbfae75480fd2347da1a50df69ddb3b8dc1cb1cab1604e41b9732dbd2021ae656a3a74671194a272d9c4aedffa5ad036b46882049a640986807c66
SSDEEP 24576:wM28t5oydiys4k1XWk6uyBWXJCirWqXNGLH5HvuVLptpWqm6xVowk8dppKEvzVBQ:Ls47TiwQ5x2uA1Y0fm1nmlUU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/952-3578-0x000000006D7C0000-0x000000006DC8E000-memory.dmp

Download

memory/952-3579-0x0000000005920000-0x0000000005941000-memory.dmp

Download

memory/952-3580-0x0000000005920000-0x0000000005941000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads