strela | 14ff76924ff2f4102e06ba9f9109311e296c3d07bf5fc0cd888c93b69b545394

Analysis

max time kernel
92s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INVOICE_1877_1553532450.js
Size 5.3MB
Sample240122-lyck4aeah7
SHA256 14ff76924ff2f4102e06ba9f9109311e296c3d07bf5fc0cd888c93b69b545394
MD5 34bcdbd3855b4a4354f3cd03e608440a
SHA1 6a8bf0531a981e6f567782801c5cfc0ef9f01a91
SHA512 55483251feda3c1ccdff42767458333aa737052d0e2c51ad1be5f1615202d3f2407cd2c3d1ca8d4e151cae3e6ca21e6fde5a4b4e5b7906b91964c9320e6e94a7
SSDEEP 24576:LioNDFYpmVzSyuXqoeJxJNK2Q9bAnWdvgTABkeW+3khCxsOwy2WHM+sJE9qP4e2g:r2map+5wnVBK3UbUt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

193.109.85.77

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
3120	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2968	1304	wscript.exe	86
PID 1304 wrote to memory of 2968	1304	wscript.exe	86
PID 2968 wrote to memory of 892	2968	cmd.exe	97
PID 2968 wrote to memory of 892	2968	cmd.exe	97
PID 2968 wrote to memory of 1520	2968	cmd.exe	98
PID 2968 wrote to memory of 1520	2968	cmd.exe	98
PID 2968 wrote to memory of 4220	2968	cmd.exe	99
PID 2968 wrote to memory of 4220	2968	cmd.exe	99
PID 4220 wrote to memory of 3120	4220	cmd.exe	100
PID 4220 wrote to memory of 3120	4220	cmd.exe	100

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\INVOICE_1877_1553532450.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\INVOICE_1877_1553532450.js" "C:\Users\Admin\AppData\Local\Temp\\faithfulpossessive.bat" && "C:\Users\Admin\AppData\Local\Temp\\faithfulpossessive.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\findstr.exe
    findstr /V skillfulmerciful ""C:\Users\Admin\AppData\Local\Temp\\faithfulpossessive.bat""
    3⤵
    PID:892
- - C:\Windows\system32\certutil.exe
    certutil -f -decode mammothsofa bulbignorant.dll
    3⤵
    PID:1520
- - C:\Windows\system32\cmd.exe
    cmd /c rundll32 bulbignorant.dll,x
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\system32\rundll32.exe
      rundll32 bulbignorant.dll,x
      4⤵
      Loads dropped DLL
      PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bulbignorant.dll

Path C:\Users\Admin\AppData\Local\Temp\bulbignorant.dll
Size 3.9MB
SHA256 c7fd534680b7119ac17af963a6f3dfc97c3894808276f284e87385cf49b285ba
MD5 acbc87f5ccf78f85146fb26690299bd1
SHA1 38d3f664f1a240937147e6870c1ad1478e761e62
SHA512 10f52a3fa495613e4fad514af7664e19df0420056d9b1d447ad779293b02658fee264fa0d383994f5b415f88cec7079d92ca9737cf4bdf30117b7130ca04bd5c
SSDEEP 24576:SqoSbKDC67eVf1DB4iGU0Id+U8cUJWWOjl9UKB:SvmJEsU4Wal99B
MD5 SHA1 SHA512 SSDEEP

Submit Download

faithfulpossessive.bat

Path C:\Users\Admin\AppData\Local\Temp\faithfulpossessive.bat
Size 5.3MB
SHA256 14ff76924ff2f4102e06ba9f9109311e296c3d07bf5fc0cd888c93b69b545394
MD5 34bcdbd3855b4a4354f3cd03e608440a
SHA1 6a8bf0531a981e6f567782801c5cfc0ef9f01a91
SHA512 55483251feda3c1ccdff42767458333aa737052d0e2c51ad1be5f1615202d3f2407cd2c3d1ca8d4e151cae3e6ca21e6fde5a4b4e5b7906b91964c9320e6e94a7
SSDEEP 24576:LioNDFYpmVzSyuXqoeJxJNK2Q9bAnWdvgTABkeW+3khCxsOwy2WHM+sJE9qP4e2g:r2map+5wnVBK3UbUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

mammothsofa

Path C:\Users\Admin\AppData\Local\Temp\mammothsofa
Size 5.2MB
SHA256 a440269f7867a54e58003b82929a525092827a6ab1d8d2cb298608b289c3beb9
MD5 633c0f0851caf2cc44727718ba335e68
SHA1 03447d779de01b237608abf5b1dc6892d36bc16c
SHA512 928c1cb57f938c14b736c7002d6a6d51d2d3234501d466bc72432477c06077ef243d7819f99f4da1996291b3f1c31d134b83d98950427f594a65c2dc28fb029c
SSDEEP 24576:+ioNDFYpmVzSyuXqoeJxJNK2Q9bAnWdvgTABkeW+3khCxsOwy2WHM+sJE9qP4e2h:Y2map+5wnVBK2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3120-8425-0x000001BBDBF00000-0x000001BBDBF21000-memory.dmp

Download

memory/3120-8426-0x00007FFE0A1D0000-0x00007FFE0A5BD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads