Analysis

  • max time kernel
    1174s
  • max time network
    1176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 13:57

General

  • Target

    3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3

  • Size

    1.8MB

  • MD5

    97ef45c0303878a80b44a236e27fd30b

  • SHA1

    14cdc83dae55ad1e6d9d5f01c7bd431db1b1654f

  • SHA256

    3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3

  • SHA512

    1f8bee9f9922b89eef565465fba7a70d45babed06a59c9e72730672bfe2f3c6e542ecb43336121e00a2bcf5b345547b61615d1c6a7b6f6753b153f914bac96ee

  • SSDEEP

    24576:S/YK0om5hQqko3/EIUaPyycFFfqcIe2c3UyWKBWM5uiSnBl37EWeG+j2Y1LHYgp8:vak

Score
10/10

Malware Config

Signatures

  • Strela

    An info stealer targeting mail credentials first seen in late 2022.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3
    1⤵
      PID:372
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1852
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3.js"
        1⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4832
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3.js" "C:\Users\Admin\\trainreproduce.bat" && "C:\Users\Admin\\trainreproduce.bat"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2368
          • C:\Windows\system32\findstr.exe
            findstr /V hammerachiever ""C:\Users\Admin\\trainreproduce.bat""
            3⤵
              PID:2964
            • C:\Windows\system32\certutil.exe
              certutil -f -decode licenseanxious alivebooks.dll
              3⤵
                PID:4248
              • C:\Windows\system32\rundll32.exe
                rundll32 alivebooks.dll,main
                3⤵
                • Loads dropped DLL
                PID:2308
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3.js"
            1⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:5076
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3.js" "C:\Users\Admin\\trainreproduce.bat" && "C:\Users\Admin\\trainreproduce.bat"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:756
              • C:\Windows\system32\findstr.exe
                findstr /V hammerachiever ""C:\Users\Admin\\trainreproduce.bat""
                3⤵
                  PID:264
                • C:\Windows\system32\certutil.exe
                  certutil -f -decode licenseanxious alivebooks.dll
                  3⤵
                    PID:840
                  • C:\Windows\system32\rundll32.exe
                    rundll32 alivebooks.dll,main
                    3⤵
                    • Loads dropped DLL
                    PID:4072
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3.js"
                1⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:4472
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3.js" "C:\Users\Admin\\trainreproduce.bat" && "C:\Users\Admin\\trainreproduce.bat"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4876
                  • C:\Windows\system32\findstr.exe
                    findstr /V hammerachiever ""C:\Users\Admin\\trainreproduce.bat""
                    3⤵
                      PID:4468
                    • C:\Windows\system32\certutil.exe
                      certutil -f -decode licenseanxious alivebooks.dll
                      3⤵
                        PID:4320
                      • C:\Windows\system32\rundll32.exe
                        rundll32 alivebooks.dll,main
                        3⤵
                        • Loads dropped DLL
                        PID:3504

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\alivebooks.dll

                    Filesize

                    1.3MB

                    MD5

                    50e82a0939f2e5e07db2883b6d8f0f57

                    SHA1

                    f9455b140bd8577d852927905ab3b432b0047b02

                    SHA256

                    0cc102da3a0f71e77164ac351b19796dad1affa0a3283753f46708ee921d762c

                    SHA512

                    2d96ce17ae184b67695f5cf017eb4af8c8e05d60df9d5a6b98f502b835bae2cfea40d393967fa6d6cd17842b2a100e629433ce79d930408e64aef0bc9d2350b7

                  • C:\Users\Admin\alivebooks.dll

                    Filesize

                    533KB

                    MD5

                    ef6035b14fd8885507ced592f336f9f8

                    SHA1

                    f636c1aa5c13f1b9d2287dc701102e65880639a7

                    SHA256

                    055735d13611e484ff4220c2b45c6d96fa72298dc841b7ed8af409b7e3845e5e

                    SHA512

                    ab177ad8c4a700d559235c994d02d41f43f549583dbccd6df8fbc5054a9ba2ddc4bc4edc1a10ea8f3c61aa79ff2f87fd8284f6b1ae4508968eed2ebdb8ba0907

                  • C:\Users\Admin\alivebooks.dll

                    Filesize

                    822KB

                    MD5

                    122cb5f616cfb20f67e1a31420f531d7

                    SHA1

                    78560db9f7801dfee3fc01f72b7154d44e17c5e4

                    SHA256

                    6d110058be6456131a573fa494d131518ff5fd76c30a975ab56e95c515a23c24

                    SHA512

                    6e3d6130e772167bd17fb95ceda2a0b61aeef8b96a14d9aa6a4125404b8b6aaeb8be03e21d8634f3f4f312cb95f3d78bc7acd072a0f7e6843a1f7497c4bddbd5

                  • C:\Users\Admin\alivebooks.dll

                    Filesize

                    665KB

                    MD5

                    a614137204d6b90175da5a1b7c5b05f7

                    SHA1

                    0eddb9b2c9afb9c61e7ec7413472a8a14253b190

                    SHA256

                    8ab76629f969514aa55d61f0439e97b0b5f1ce5af843eeb33d65ca50b1d9848b

                    SHA512

                    964aa24f1000635e08015bac80c210638a6e188f5002cb1ad84c94514befea25bc9430fd2bb40514739062405d1da58a24ae191fbf9118f6f2ddec28e37496a3

                  • C:\Users\Admin\alivebooks.dll

                    Filesize

                    696KB

                    MD5

                    e827253fbfeaa39f6465bbbe8ef6f9e1

                    SHA1

                    8a0a53da7d7d38d1023fb31feaeb5da71e61e428

                    SHA256

                    9e565ee1fd4b16c66d06e274a2ed04439b9368af613798ba189db6873c8b350c

                    SHA512

                    1521a179c31b7afaab8e93cd8877dbd838a6dc77a8014614f571b72b5f3824f5fb8bb1f751f2870f8c46b3032f03630ec950b604e5fbdc360748fdaeba74c587

                  • C:\Users\Admin\licenseanxious

                    Filesize

                    1.8MB

                    MD5

                    cccbee3669234b546da8c922dae5515b

                    SHA1

                    6545a901c5b40a29967ed0c30e308a413485bbf9

                    SHA256

                    2ddcf13b108c3cda14cff5ff089539281bc95b6072a16aed5e5432d46daaa5ce

                    SHA512

                    6107ed80789bade3e624b742f76d5f409c7dc4005ad8d2caf192bd8b2b58adf84d0e1a61ea7559088baad3bfc2b130fe208a2162b49e0f297775db594b7b857c

                  • C:\Users\Admin\licenseanxious

                    Filesize

                    782KB

                    MD5

                    e0fdf13959e902a8f04ad8ac419bef7a

                    SHA1

                    ad18df88debbd0af8d8c623cf1823b983ab80e8f

                    SHA256

                    0cd50f9403330cac7c06718af50d83789b805310c2a207abc3507aaab1c24a08

                    SHA512

                    7f4221702ceafd91991129ed28d5e12efa7f7261763359f5bda77c724531ba68cbf7f7e2f1d7806682bf1bc5f090ed18fa081b2eab3708f994995fcd6947fb2d

                  • C:\Users\Admin\licenseanxious

                    Filesize

                    704KB

                    MD5

                    bab0014deb14f24d20658e95e1e32f65

                    SHA1

                    ed17543cf92b081d78c090a972ae4f49435746b3

                    SHA256

                    7f3f8cd9dbc11e09a65d9a92e46c5ec5b8fc547617057883a80342e75d6329f9

                    SHA512

                    a1bff1f0774bcb671cda9c1c9767ec5727e568f6b723deb5a5ddca7f41a39b91cd1c8d74617a91a6a17e69dc39f615df773f4ebc89506830c7c381ee8bf52b82

                  • C:\Users\Admin\trainreproduce.bat

                    Filesize

                    1.6MB

                    MD5

                    7b9b251c87bd3959eb6daf22ef5a95d4

                    SHA1

                    57dddbb33d9769993a4633dcdb9341c6d3611979

                    SHA256

                    81b8ea02158c925448668d5c041e8b83856b293ed31886c5921d0ad60a3f4f11

                    SHA512

                    c6503cdd38e539669cd7d64c402a450205bbaa6176bbea3bea855ce0ad868de7bf47843be81165ba24ddbdde8cb7d7f3a29a3550b2a869728fc28cdb00f988ac

                  • C:\Users\Admin\trainreproduce.bat

                    Filesize

                    1.8MB

                    MD5

                    97ef45c0303878a80b44a236e27fd30b

                    SHA1

                    14cdc83dae55ad1e6d9d5f01c7bd431db1b1654f

                    SHA256

                    3b1e6f545d77b1999b877967fd736c7ba01531b26874311b436d014f91803bf3

                    SHA512

                    1f8bee9f9922b89eef565465fba7a70d45babed06a59c9e72730672bfe2f3c6e542ecb43336121e00a2bcf5b345547b61615d1c6a7b6f6753b153f914bac96ee

                  • C:\Users\Admin\trainreproduce.bat

                    Filesize

                    1.8MB

                    MD5

                    f420c6e2b75278a05ada549649e5fb59

                    SHA1

                    ceacf069d47b036480b968d0b3048a88f62d040d

                    SHA256

                    d3319da67e41d37b6b9358403577e6440316643d76191abdc3cdb63f73a0f5ff

                    SHA512

                    0081b834ff8a33d379d44b6868d78a6e0ed44774d922d975382af6bfbe8994867f2b9b3376f6000e2b4617afcdc44d79c5923bcb97d50521365022ff46db01fe

                  • memory/2308-1770-0x00007FFEBEC20000-0x00007FFEBED79000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/2308-1771-0x000001B6CD940000-0x000001B6CD963000-memory.dmp

                    Filesize

                    140KB

                  • memory/3504-5315-0x000001C7D13A0000-0x000001C7D13C3000-memory.dmp

                    Filesize

                    140KB

                  • memory/3504-5314-0x00007FFEC9950000-0x00007FFEC9AA9000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/4072-3542-0x00007FFEBEC20000-0x00007FFEBED79000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/4072-3543-0x000001CC874C0000-0x000001CC874E3000-memory.dmp

                    Filesize

                    140KB