strela | 14ff76924ff2f4102e06ba9f9109311e296c3d07bf5fc0cd888c93b69b545394

General

Target
INVOICE_1877_1553532450.js
Size 5.3MB
Sample240122-ly19fsdfel
SHA256 14ff76924ff2f4102e06ba9f9109311e296c3d07bf5fc0cd888c93b69b545394
MD5 34bcdbd3855b4a4354f3cd03e608440a
SHA1 6a8bf0531a981e6f567782801c5cfc0ef9f01a91
SHA512 55483251feda3c1ccdff42767458333aa737052d0e2c51ad1be5f1615202d3f2407cd2c3d1ca8d4e151cae3e6ca21e6fde5a4b4e5b7906b91964c9320e6e94a7
SSDEEP 24576:LioNDFYpmVzSyuXqoeJxJNK2Q9bAnWdvgTABkeW+3khCxsOwy2WHM+sJE9qP4e2g:r2map+5wnVBK3UbUt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
1892	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2100	2280	wscript.exe	86
PID 2280 wrote to memory of 2100	2280	wscript.exe	86
PID 2100 wrote to memory of 1388	2100	cmd.exe	98
PID 2100 wrote to memory of 1388	2100	cmd.exe	98
PID 2100 wrote to memory of 1420	2100	cmd.exe	99
PID 2100 wrote to memory of 1420	2100	cmd.exe	99
PID 2100 wrote to memory of 3260	2100	cmd.exe	101
PID 2100 wrote to memory of 3260	2100	cmd.exe	101
PID 3260 wrote to memory of 1892	3260	cmd.exe	100
PID 3260 wrote to memory of 1892	3260	cmd.exe	100

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\INVOICE_1877_1553532450.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\INVOICE_1877_1553532450.js" "C:\Users\Admin\AppData\Local\Temp\\faithfulpossessive.bat" && "C:\Users\Admin\AppData\Local\Temp\\faithfulpossessive.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\findstr.exe
    findstr /V skillfulmerciful ""C:\Users\Admin\AppData\Local\Temp\\faithfulpossessive.bat""
    3⤵
    PID:1388
- - C:\Windows\system32\certutil.exe
    certutil -f -decode mammothsofa bulbignorant.dll
    3⤵
    PID:1420
- - C:\Windows\system32\cmd.exe
    cmd /c rundll32 bulbignorant.dll,x
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3260

C:\Windows\system32\rundll32.exe
rundll32 bulbignorant.dll,x
1⤵
- Loads dropped DLL
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bulbignorant.dll

Path C:\Users\Admin\AppData\Local\Temp\bulbignorant.dll
Size 1.9MB
SHA256 9db302ae39116a3cc5141b2a1e3d75f504b90d1e2a534e84b7d14d8fae50ead4
MD5 7fdbd8e5f40aa26c7408acb5135e9ba6
SHA1 5f930542d15501871418a366950a047be575f6c7
SHA512 584fe9740fb0f6911dc1c2a163781f616546d16236520b776af31a974ded10a9b74b463130e69fa90e7b900692a7dc2b6e4b5bade84c0e14bfd3222377f2bb40
SSDEEP 12288:SeU2uSKJYbQLDCKHk6+o76OUp/Ger4vjmbaPJc6K9pB4iG4Nd+W:SqoSbKDC67eVf1DB4iGU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

bulbignorant.dll

Path C:\Users\Admin\AppData\Local\Temp\bulbignorant.dll
Size 2.3MB
SHA256 1044e9f48523fa7656749a7495ae041b47d14f6d800048831a3a2788064e0264
MD5 5546cd9ff3bc480656fa5a10b24b52bd
SHA1 31a71df7f6b3f891cc0a86b0282bf92390c99889
SHA512 5bd0aa223a1714d6478e8d2b3cd9002fe4b151bba233fc07da184d7209eafc3b104dcaac833595867517a5c8cf218f1a4d90b1318631a218db620b7454d4e0e7
SSDEEP 12288:SeU2uSKJYbQLDCKHk6+o76OUp/Ger4vjmbaPJc6K9pB4iG4Nd+fE8N8c:SqoSbKDC67eVf1DB4iGU03
MD5 SHA1 SHA512 SSDEEP

Submit Download

faithfulpossessive.bat

Path C:\Users\Admin\AppData\Local\Temp\faithfulpossessive.bat
Size 1.5MB
SHA256 6bae24e1e106d6baa2c18da16514573825af6487e08283b862ae9e862b1065b8
MD5 400cf18ddcf85d59ef822b48410c6c9b
SHA1 5f3ec44cccacdd894f299dd8e674d3a7fc45e5d1
SHA512 dd8f9c7da4eac3f2b47da3f97e65d3ec7c99c4471edf0fc66b3764157bee6112f27cf16cdcbb12f49f9451f9e4b6fd87252f2b213cefb95ae46eaa6888229e3f
SSDEEP 24576:LioNDFYpmVzSyuXqoeJxJNK2Q9bAnWdvgTABkeW+3khCxsOwy2WHM+sJE9qP4e2k:r2mR
MD5 SHA1 SHA512 SSDEEP

Submit Download

faithfulpossessive.bat

Path C:\Users\Admin\AppData\Local\Temp\faithfulpossessive.bat
Size 3.1MB
SHA256 32e23b71e2083b679cda0eef6c7fad5d3be4e9c2d748fb386c9d51f22726344b
MD5 f9104f2cf870c336d319af8c9908673f
SHA1 ca2fed90d1697e69b1d98b924bc3f06433de9fa2
SHA512 526e64749cf4ea55b2a3e6239999190bd84ba34ff70ce30a0b4da8d296652d527ec562f2abb7e136d146a2a02cd6ea9d5d07d91c7e60eed07e6b1ab5f8c4ec8e
SSDEEP 24576:LioNDFYpmVzSyuXqoeJxJNK2Q9bAnWdvgTABkeW+3khCxsOwy2WHM+sJE9qP4e2d:r2map+5wb
MD5 SHA1 SHA512 SSDEEP

Submit Download

mammothsofa

Path C:\Users\Admin\AppData\Local\Temp\mammothsofa
Size 2.2MB
SHA256 140a48ec38493e88764cfbf194261a6d34bb84cc4ec1bb85bff13d6342513468
MD5 750009d104c5ce1e8bcb00d65e266c52
SHA1 7ec4778f49ce97b9774930f49ad08226eee3dd3a
SHA512 675c98c794f1b9a10aeae876b27f68c39166f84f5c4404940d9f397ea5315708a57e65d953b9fbcf3b2074fab9b273823cb2f92cde223482d38cf46e7b771ba1
SSDEEP 24576:+ioNDFYpmVzSyuXqoeJxJNK2Q9bAnWdvgTABkeW+3khCxsOwy2WHM+sJE9qP4e25:Y2mapF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1892-8425-0x00007FFCA0520000-0x00007FFCA090D000-memory.dmp

Download

memory/1892-8426-0x0000013908060000-0x0000013908081000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads