strela | ce01439b4563ef42d1536e99b4147a083f227a6639b18a4e4d9944618e4338c4

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2024, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kindergarten-wiesenbronn.js
Size 1001KB
Sample240209-kt955abf77
SHA256 95e0322d029d6cda1d65a9def576455be66a7520f14fd2eabcecf1f5ddeec5e1
MD5 cf65d4687c41648679c9cdcb24a0e824
SHA1 f3966ccd310aba1e6161015f6cf6c04ccb005c0f
SHA512 e1f2bf2156459b6c5c54bdcf1ac9e86d00d4d8f181d3ae5cf0bd890e683fc19d7c6d7aa10ae826903cdd46aaae9dc4bcd2ee709e5b6343401d002f841ebb1d25
SSDEEP 24576:lEn1bqD0a6qak7WQzNPpWTUqiVzGzLcD2g5c08sir:4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

91.215.85.209

Signatures

Strela
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
1420	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3952	5088	wscript.exe	84
PID 5088 wrote to memory of 3952	5088	wscript.exe	84
PID 3952 wrote to memory of 3292	3952	cmd.exe	86
PID 3952 wrote to memory of 3292	3952	cmd.exe	86
PID 3952 wrote to memory of 1880	3952	cmd.exe	87
PID 3952 wrote to memory of 1880	3952	cmd.exe	87
PID 3952 wrote to memory of 1420	3952	cmd.exe	88
PID 3952 wrote to memory of 1420	3952	cmd.exe	88

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\kindergarten-wiesenbronn.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\kindergarten-wiesenbronn.js" "C:\Users\Admin\AppData\Local\Temp\GW54GT.bat" && "C:\Users\Admin\AppData\Local\Temp\GW54GT.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\system32\findstr.exe
    FINDSTR /V S7MOTM ""C:\Users\Admin\AppData\Local\Temp\GW54GT.bat""
    3⤵
    PID:3292
- - C:\Windows\system32\certutil.exe
    CERTUTIL -f -DEcODEhEX K4CFQY FZ7JDQ.dll
    3⤵
    PID:1880
- - C:\Windows\system32\rundll32.exe
    ruNDLL32 FZ7JDQ.dll,f
    3⤵
    - Loads dropped DLL
    PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FZ7JDQ.dll

Path C:\Users\Admin\AppData\Local\Temp\FZ7JDQ.dll
Size 333KB
SHA256 cfbb6eb60214fcccb2a3e868b4ff6b4ccceecffa50057582be87c4c9f3216c4a
MD5 5d96f1a31b68f6449fbd50457b14e280
SHA1 8db7c9989062797441b69eebd1f2cd07e2199a22
SHA512 2ea1ce39ae4c8a9d4620013d0919311dcb8c9e3958991d4bf4059dfd99e3a3d4e9396a07ae73d7a983e2c0d6cb4f031418d62e1ab5729fe4303b4b1d722bfaa7
SSDEEP 6144:heOWknU21Sn0VdYhK6OdyVj42xYdYf06vTKGq:hhh1SE6mK5cYf06rKh
MD5 SHA1 SHA512 SSDEEP

Submit Download

GW54GT.bat

Path C:\Users\Admin\AppData\Local\Temp\GW54GT.bat
Size 1001KB
SHA256 95e0322d029d6cda1d65a9def576455be66a7520f14fd2eabcecf1f5ddeec5e1
MD5 cf65d4687c41648679c9cdcb24a0e824
SHA1 f3966ccd310aba1e6161015f6cf6c04ccb005c0f
SHA512 e1f2bf2156459b6c5c54bdcf1ac9e86d00d4d8f181d3ae5cf0bd890e683fc19d7c6d7aa10ae826903cdd46aaae9dc4bcd2ee709e5b6343401d002f841ebb1d25
SSDEEP 24576:lEn1bqD0a6qak7WQzNPpWTUqiVzGzLcD2g5c08sir:4
MD5 SHA1 SHA512 SSDEEP

Submit Download

K4CFQY

Path C:\Users\Admin\AppData\Local\Temp\K4CFQY
Size 1001KB
SHA256 f42cc8f1b5c5242e53ec1243ae4e2af167a7b2722cf040944e4289ee5aec2c16
MD5 4263cc10f04dc0aa11486669da00d9b2
SHA1 84276ef5f7f2afb0f41c92f60eb5a75b8e234add
SHA512 912964b813c348550d8dc2e8dde4f9dcce9715bddf0d6b6dcc56f8bf9c96e387c1d97dd0b73b24691acec14ad03747e7d8477afeed8ff5767605a9c80e95c629
SSDEEP 24576:tEn1bqD0a6qak7WQzNPpWTUqiVzGzLcD2g5c08si/:W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1420-15-0x000002138C5B0000-0x000002138C5D1000-memory.dmp

Download

memory/1420-16-0x000000006D7C0000-0x000000006D81B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads