strela | a604d0cf8041c9e156f74c90d4abf53f28b695ab03d6b5dfb034a6c833fced1b

Analysis

max time kernel
129s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.js
Size 4.2MB
Sample240109-n6weaaheep
SHA256 a604d0cf8041c9e156f74c90d4abf53f28b695ab03d6b5dfb034a6c833fced1b
MD5 f775c9021104377f50b35c575b9297a8
SHA1 bcc02efb0ef345677c161030d2bbb6d7a6b0f118
SHA512 1879ccba16e67c89c735b67249999afee25407262ff4d3f96240a45e8401ef09b1fef71a450331fa808ab5b1f9007d1f0bec2fc810897c5788ccd5e64216a1eb
SSDEEP 24576:iBL/aX6WpQlCuQSAFLrjHTExzK6fEGBRRQs1IJVK1HafYbqxkcdRGb4OOvGSe0OU:lhPYUt5N0XWjV+fm6OXYUbU0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
4528	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4472	2576	wscript.exe	93
PID 2576 wrote to memory of 4472	2576	wscript.exe	93
PID 4472 wrote to memory of 2612	4472	cmd.exe	101
PID 4472 wrote to memory of 2612	4472	cmd.exe	101
PID 4472 wrote to memory of 4576	4472	cmd.exe	102
PID 4472 wrote to memory of 4576	4472	cmd.exe	102
PID 4472 wrote to memory of 4368	4472	cmd.exe	104
PID 4472 wrote to memory of 4368	4472	cmd.exe	104
PID 4368 wrote to memory of 4528	4368	cmd.exe	105
PID 4368 wrote to memory of 4528	4368	cmd.exe	105

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\3.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\3.js" "C:\Users\Admin\AppData\Local\Temp\\visitrepeat.bat" && "C:\Users\Admin\AppData\Local\Temp\\visitrepeat.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\findstr.exe
    findstr /V songssour ""C:\Users\Admin\AppData\Local\Temp\\visitrepeat.bat""
    3⤵
    PID:2612
- - C:\Windows\system32\certutil.exe
    certutil -f -decode cleveroatmeal doctorprovide.dll
    3⤵
    PID:4576
- - C:\Windows\system32\cmd.exe
    cmd /c rundll32 doctorprovide.dll,x
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\system32\rundll32.exe
      rundll32 doctorprovide.dll,x
      4⤵
      Loads dropped DLL
      PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleveroatmeal

Path C:\Users\Admin\AppData\Local\Temp\cleveroatmeal
Size 4.1MB
SHA256 c7578f90b0a9a03e6e43cf0bc29dc35d50edbbcfcfc91bbeb9898df619c770ed
MD5 f12e5034f01173ba61ac25ba60cf7ba7
SHA1 58a78f165bc97d8e0901382fdc8a60113f0c6118
SHA512 0177db8afd6c4f6effa19a4cd124d0c8d0c938a463705ef21c65f929f4a8801bca5406e8c740e78600a19725920bb037edacfd633330ba249c7a3f08841a5f0b
SSDEEP 24576:iBL/aX6WpQlCuQSAFLrjHTExzK6fEGBRRQs1IJVK1HafYbqxkcdRGb4OOvGSe0Oi:lhPYUt5N0XWjV+fm6OXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

doctorprovide.dll

Path C:\Users\Admin\AppData\Local\Temp\doctorprovide.dll
Size 3.1MB
SHA256 3942c9509723dba75edc4ea05673864654283de6213591728a4691d22bc44dd1
MD5 ae090426301c2bc46dae1691a799bb8c
SHA1 cf143b48a36658fbbbf46b55498dc52ce1a75041
SHA512 d42ec6c4fd1afac52431c76901bdb3daad339681622d4668508e91e4b1a2581499a7743e0df1172689d4d033861a8a2651fb096d3a3f7f6695bc26985100603d
SSDEEP 24576:fg8WUczrYimQfEePxwjKi6NUSUeMjz4ILCYKbY3klwP4ZhhLKDItgilbq4zPbsXK:PI7qKQ0GGiBV3AB
MD5 SHA1 SHA512 SSDEEP

Submit Download

visitrepeat.bat

Path C:\Users\Admin\AppData\Local\Temp\visitrepeat.bat
Size 4.2MB
SHA256 a604d0cf8041c9e156f74c90d4abf53f28b695ab03d6b5dfb034a6c833fced1b
MD5 f775c9021104377f50b35c575b9297a8
SHA1 bcc02efb0ef345677c161030d2bbb6d7a6b0f118
SHA512 1879ccba16e67c89c735b67249999afee25407262ff4d3f96240a45e8401ef09b1fef71a450331fa808ab5b1f9007d1f0bec2fc810897c5788ccd5e64216a1eb
SSDEEP 24576:iBL/aX6WpQlCuQSAFLrjHTExzK6fEGBRRQs1IJVK1HafYbqxkcdRGb4OOvGSe0OU:lhPYUt5N0XWjV+fm6OXYUbU0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4528-4867-0x00007FFE099E0000-0x00007FFE09CF8000-memory.dmp

Download

memory/4528-4874-0x000002DD389D0000-0x000002DD389F1000-memory.dmp

Download

memory/4528-4875-0x00007FFE099E0000-0x00007FFE09CF8000-memory.dmp

Download

memory/4528-4876-0x000002DD389D0000-0x000002DD389F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads