strela | a604d0cf8041c9e156f74c90d4abf53f28b695ab03d6b5dfb034a6c833fced1b

General

Target
I262231109.js
Size 4.2MB
Sample240108-2gp3vsdggk
SHA256 a604d0cf8041c9e156f74c90d4abf53f28b695ab03d6b5dfb034a6c833fced1b
MD5 f775c9021104377f50b35c575b9297a8
SHA1 bcc02efb0ef345677c161030d2bbb6d7a6b0f118
SHA512 1879ccba16e67c89c735b67249999afee25407262ff4d3f96240a45e8401ef09b1fef71a450331fa808ab5b1f9007d1f0bec2fc810897c5788ccd5e64216a1eb
SSDEEP 24576:iBL/aX6WpQlCuQSAFLrjHTExzK6fEGBRRQs1IJVK1HafYbqxkcdRGb4OOvGSe0OU:lhPYUt5N0XWjV+fm6OXYUbU0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
4728	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 400	3068	wscript.exe	33
PID 3068 wrote to memory of 400	3068	wscript.exe	33
PID 400 wrote to memory of 4144	400	cmd.exe	102
PID 400 wrote to memory of 4144	400	cmd.exe	102
PID 400 wrote to memory of 3944	400	cmd.exe	101
PID 400 wrote to memory of 3944	400	cmd.exe	101
PID 400 wrote to memory of 392	400	cmd.exe	104
PID 400 wrote to memory of 392	400	cmd.exe	104
PID 392 wrote to memory of 4728	392	cmd.exe	103
PID 392 wrote to memory of 4728	392	cmd.exe	103

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\I262231109.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\I262231109.js" "C:\Users\Admin\AppData\Local\Temp\\visitrepeat.bat" && "C:\Users\Admin\AppData\Local\Temp\\visitrepeat.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\system32\certutil.exe
    certutil -f -decode cleveroatmeal doctorprovide.dll
    3⤵
    PID:3944
- - C:\Windows\system32\findstr.exe
    findstr /V songssour ""C:\Users\Admin\AppData\Local\Temp\\visitrepeat.bat""
    3⤵
    PID:4144
- - C:\Windows\system32\cmd.exe
    cmd /c rundll32 doctorprovide.dll,x
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392

C:\Windows\system32\rundll32.exe
rundll32 doctorprovide.dll,x
1⤵
- Loads dropped DLL
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleveroatmeal

Path C:\Users\Admin\AppData\Local\Temp\cleveroatmeal
Size 482KB
SHA256 d525b80430fd7b4ce388ee0e8b30d26548d3dc4721f187360e4ae3c5c22a98fd
MD5 1417fee8e42904d4ccf1f0b788487cb6
SHA1 c0afd72b82fb7ecf30a4a06e217ec35e2a3655b8
SHA512 6f29a46e6e2b37e7a54295b704e766f6756be3e0047b3ece730c4136a461d3fb8d86ac015678f5685306b04e60370f880b3c8d2627aae0815863d8a9ef4f01c5
SSDEEP 12288:B0BvUx+/aX6WpQlKOWmaeqrTu09BSZfRJhm1ZFuw/rjH6q4:iBL/aX6WpQlCuQSAFLrjHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

doctorprovide.dll

Path C:\Users\Admin\AppData\Local\Temp\doctorprovide.dll
Size 667KB
SHA256 a2fc9f871d0bee3a18a25ca573fe8fe065a641c6b786231229f5f026a14a918f
MD5 cb1f3e2dcbea5a96bf27939a8253eec5
SHA1 f456a16f99063580783444ec2e50dcf7599413e2
SHA512 be6c62dbe185fd1f80fd9447b158724963f045912975f56cf5b9b442f4bd06929f6d9bc474dcded4d2c72de2e566b10f0cbbe6091333ed96447b447c77c703eb
SSDEEP 12288:favX8WURQc+3XWaBrYTqKcmfofEePXjmxPIS+zTBadry:fg8WUczrYimQfEePxt
MD5 SHA1 SHA512 SSDEEP

Submit Download

doctorprovide.dll

Path C:\Users\Admin\AppData\Local\Temp\doctorprovide.dll
Size 693KB
SHA256 e9abfa927072ef7f191131464ecb65a719df548a087ce3e5c12d72dcc118f852
MD5 035b578371bd969c8613fe43b344ce8c
SHA1 75d795f9b468b14b1c784ae4d98c2ad7115c651f
SHA512 f610afdf4618c6095e070e019725b177cddd71c0657d8cf9798ca049fb2c635744e40226e301bfe2a168d3f2ac268757bfdf97b05dfad2fd954d5befda00a352
SSDEEP 12288:favX8WURQc+3XWaBrYTqKcmfofEePXjmxPIS+zTBadrZjKU:fg8WUczrYimQfEePxwjKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

visitrepeat.bat

Path C:\Users\Admin\AppData\Local\Temp\visitrepeat.bat
Size 438KB
SHA256 565ff8850f62d07b07f3a45790c64205be4ebde2ba5e20b9e6bf7392730b0796
MD5 bb4a62b8db1fb62293862fab1d3605dd
SHA1 efa0cb50ad0164dc42ae9b5a759d9d051cb0aba4
SHA512 28bc6806acaa222cbe98bc64b44a8f64fa385c79f896b728312a35331696bb5624c26af2a33962c783aa5eb9d30f62ae8d95edb751ba6815832e88b4ae6c64bc
SSDEEP 12288:B0BvUx+/aX6WpQlKOWmaeqrTu09BSZfRJhm1ZFuw/rjO:iBL/aX6WpQlCuQSAFLrjO
MD5 SHA1 SHA512 SSDEEP

Submit Download

visitrepeat.bat

Path C:\Users\Admin\AppData\Local\Temp\visitrepeat.bat
Size 40KB
SHA256 82d42e4ef69bc2bfd1cd9959141a1c39b392bb89370e0d29436ba492d4709e5e
MD5 d5bd30ae9f597e0ed7840629de91f0b8
SHA1 66f42a81dda2a705447ba396c2369603ad7a1032
SHA512 b07bde2fc4bff43dc87e266be4cc39de77375ef38473be7d416080f0e4a7d915c078b8afcaa5d13a4d2f9b40cc553f0be4635c05f2a89d70fd8a2f3f1005c8fb
SSDEEP 768:hCE9COgrIPRAPjp065NLAhCd6BXENverNXsSgfUayi:hCEEIPKvD0hCd6mve5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4728-4867-0x00007FF97E350000-0x00007FF97E668000-memory.dmp

Download

memory/4728-4870-0x00007FF97E350000-0x00007FF97E668000-memory.dmp

Download

memory/4728-4871-0x00000252D8D00000-0x00000252D8D21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads