strela | 41e60d8e1802d173e24b105ca79af2d2f075d9909565a82fd4f5c8db2b7ed970

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2024, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21421687800828945.js
Size 659KB
Sample240208-rm4s4aed31
SHA256 e7c76677638bff695482f75513f4f538ae51fe8b1f0c6d7fc5f1c3ccec8217fd
MD5 2cea45454e7fef730082be9b5ce5f37d
SHA1 b352487247c1e49bea04fae3972cc2af00bc7e23
SHA512 d5407c8699377075f2a62673e50097bc04f35abc935587f4d9ca325daedccad2c2a3c3dd28a2e46c5aaae0d86a4d7ee95ebc5f46f9b602d8837b1bae8902ae1b
SSDEEP 6144:QVyDIReG024jLFNwNBHntoF/knEXjbm0KGm63EYnkkenxf2SeefVZwzqzB0tf7gD:SyDI0/fFNwNVnZGN0YnkR+tfVWt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
4736	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1568	3524	wscript.exe	84
PID 3524 wrote to memory of 1568	3524	wscript.exe	84
PID 1568 wrote to memory of 3940	1568	cmd.exe	86
PID 1568 wrote to memory of 3940	1568	cmd.exe	86
PID 1568 wrote to memory of 764	1568	cmd.exe	87
PID 1568 wrote to memory of 764	1568	cmd.exe	87
PID 1568 wrote to memory of 1608	1568	cmd.exe	88
PID 1568 wrote to memory of 1608	1568	cmd.exe	88
PID 1608 wrote to memory of 4736	1608	cmd.exe	89
PID 1608 wrote to memory of 4736	1608	cmd.exe	89

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\21421687800828945.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\21421687800828945.js" "C:\Users\Admin\\creamjudicious.bat" && "C:\Users\Admin\\creamjudicious.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\findstr.exe
    findstr /V creatorerror ""C:\Users\Admin\\creamjudicious.bat""
    3⤵
    PID:3940
- - C:\Windows\system32\certutil.exe
    certutil -f -decode bruiseagonizing abandonedcloth.dll
    3⤵
    PID:764
- - C:\Windows\system32\cmd.exe
    cmd /C rundll32 abandonedcloth.dll,main
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\system32\rundll32.exe
      rundll32 abandonedcloth.dll,main
      4⤵
      Loads dropped DLL
      PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

abandonedcloth.dll

Path C:\Users\Admin\abandonedcloth.dll
Size 238KB
SHA256 75d4bd2aa84ca70747849addd5db9cd797717c21c6a87232e965e7f4def5987b
MD5 e3126e41a0a0b7925cd6c37dfe4e1946
SHA1 777f9b13f5b4cc1d989e3b732ace0f560cb3ebb2
SHA512 5a6d83ffcee496b0c80dcd5ee9bfbb62ae7e9f65ed818f9059229ca42a1832d47a4647ccb8ddeae61989722288f040dd6f077107be6f1dd7c9657811c401ba8d
SSDEEP 3072:a7gGgMCmi5zob0LKpApGd/zGNP89zrrwhvH9yeSZg8lyTsq5DkIV1iYaANsUB:ZKWO4Pq/8HWZgSyTLDnkUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

bruiseagonizing

Path C:\Users\Admin\bruiseagonizing
Size 318KB
SHA256 7dadbcf20f871ac6bfc4738b2ef4e476e8a1069f3eddfd92d967cc8df96b9593
MD5 03c4a62bb98e0b86cef66adbf8c8e5fe
SHA1 6feb2833802e38972cc43f3995489d9380383908
SHA512 14094c9ae70e7273c3c4fc2a68972eac2b52fc07b02de54536f25475a594db5f8fdefce812ac2153c6a5e732328ec3fb24e4652ddf344bdd43f8f95581512fa3
SSDEEP 3072:xz5y6vARg2sReTKqTRA4jLFJZ1NRR3ypt+sYokE0B8vKpejLD5oEOlyVXEBKKon4:xVyDIReG024jLFNwNBHntoF/knEXh
MD5 SHA1 SHA512 SSDEEP

Submit Download

creamjudicious.bat

Path C:\Users\Admin\creamjudicious.bat
Size 659KB
SHA256 e7c76677638bff695482f75513f4f538ae51fe8b1f0c6d7fc5f1c3ccec8217fd
MD5 2cea45454e7fef730082be9b5ce5f37d
SHA1 b352487247c1e49bea04fae3972cc2af00bc7e23
SHA512 d5407c8699377075f2a62673e50097bc04f35abc935587f4d9ca325daedccad2c2a3c3dd28a2e46c5aaae0d86a4d7ee95ebc5f46f9b602d8837b1bae8902ae1b
SSDEEP 6144:QVyDIReG024jLFNwNBHntoF/knEXjbm0KGm63EYnkkenxf2SeefVZwzqzB0tf7gD:SyDI0/fFNwNVnZGN0YnkR+tfVWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4736-172-0x00007FFD70F40000-0x00007FFD70F83000-memory.dmp

Download

memory/4736-173-0x000001F7DFAF0000-0x000001F7DFB13000-memory.dmp

Download

memory/4736-174-0x000001F7DFAF0000-0x000001F7DFB13000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads