strela | 51fae6ff6a5f204c0255eb45782625d68d18df04cc6318cafa402b0e94766a74

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
147981734725653.js
Size 1.1MB
Sample240130-m7cswsefc5
SHA256 7b513b60bf0c42e4dea6b545591088954a1ed63348d085cbeee97c03ef163a42
MD5 f0aa642d6a0e4a0021bb5a006da8f659
SHA1 6da83194b6e3acb7fa7537b179b96c0a21654983
SHA512 bd023360956eec5c06bd322d52d3881072955f6b22b9e99cdaf4f2a3f726d23e8bab0f3ab85d2bfaafbbfa5c696683026dbd50c7a5849e8aee893083662ae41e
SSDEEP 12288:3lyp9BJQJzEk/e0clTeD1FUEnYC1b3XC4Ksl8iUVfloiMKQsKJlmgAzE27UKEZtl:olcDR666E/NSnGQbR3xGJZ3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
368	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4424	4812	wscript.exe	84
PID 4812 wrote to memory of 4424	4812	wscript.exe	84
PID 4424 wrote to memory of 5072	4424	cmd.exe	92
PID 4424 wrote to memory of 5072	4424	cmd.exe	92
PID 4424 wrote to memory of 632	4424	cmd.exe	93
PID 4424 wrote to memory of 632	4424	cmd.exe	93
PID 4424 wrote to memory of 3880	4424	cmd.exe	94
PID 4424 wrote to memory of 3880	4424	cmd.exe	94
PID 3880 wrote to memory of 368	3880	cmd.exe	95
PID 3880 wrote to memory of 368	3880	cmd.exe	95

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\147981734725653.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\147981734725653.js" "C:\Users\Admin\AppData\Local\Temp\\killwindow.bat" && "C:\Users\Admin\AppData\Local\Temp\\killwindow.bat"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\findstr.exe
    findstr /V stickykick ""C:\Users\Admin\AppData\Local\Temp\\killwindow.bat""
    3⤵
    PID:5072
- - C:\Windows\system32\certutil.exe
    certutil -f -decode economicknife playgroundstructure.dll
    3⤵
    PID:632
- - C:\Windows\system32\cmd.exe
    cmd /c rundll32 playgroundstructure.dll,m
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\system32\rundll32.exe
      rundll32 playgroundstructure.dll,m
      4⤵
      Loads dropped DLL
      PID:368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

economicknife

Path C:\Users\Admin\AppData\Local\Temp\economicknife
Size 1.1MB
SHA256 8ef40cddfde7f269cee9d4167f78540c74a5176c11a875d3e139b39d784616d2
MD5 b1eb68af4adfd3c1b2c9bebc96f7476f
SHA1 c0b9a3b8b98a07884d6a200c9f1f4789584efffe
SHA512 5e9860af3ac660b24a41bbffd3b4b1b6fad213cc22efe7eeb103384e1b237e21f610cec63743f5329a9ad0c4b0452e5bb9eb56ca70a10b7b23240de5f2696bba
SSDEEP 12288:Wlyp9BJQJzEk/e0clTeD1FUEnYC1b3XC4Ksl8iUVfloiMKQsKJlmgAzE27UKEZty:rlcDR666E/NSnGQbR3xGJZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

killwindow.bat

Path C:\Users\Admin\AppData\Local\Temp\killwindow.bat
Size 1.1MB
SHA256 7b513b60bf0c42e4dea6b545591088954a1ed63348d085cbeee97c03ef163a42
MD5 f0aa642d6a0e4a0021bb5a006da8f659
SHA1 6da83194b6e3acb7fa7537b179b96c0a21654983
SHA512 bd023360956eec5c06bd322d52d3881072955f6b22b9e99cdaf4f2a3f726d23e8bab0f3ab85d2bfaafbbfa5c696683026dbd50c7a5849e8aee893083662ae41e
SSDEEP 12288:3lyp9BJQJzEk/e0clTeD1FUEnYC1b3XC4Ksl8iUVfloiMKQsKJlmgAzE27UKEZtl:olcDR666E/NSnGQbR3xGJZ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

playgroundstructure.dll

Path C:\Users\Admin\AppData\Local\Temp\playgroundstructure.dll
Size 805KB
SHA256 cce183b5df0c236e4d89fb64d34c35909b7fc04c54b3447340b2c44dd7030593
MD5 6a1f4bd07b38e35b007978bb130742b5
SHA1 fa396ca0dcc3738555f07c6ffbcbbd48ab67de92
SHA512 e9dab28fb33f2cec7dec5332236a55554d5ba6e8eaea92cd7e6b0c47dbce8b08c7b45e4c11abd017f4cddd7930ee7214abefeccecba68362157f24710906b657
SSDEEP 6144:FfytbEAfw50s32eTgi0XXn3x/00T1cEAW8Gv5r4WqaR3hGNLgFmULoZWK3FbMvaE:wPC0b4WVBxRSfL69AzJ2xHy3IzEIn1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-1756-0x00007FF984A10000-0x00007FF984AE1000-memory.dmp

Download

memory/368-1757-0x00000214EC770000-0x00000214EC793000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads