strela | d4ef23361e77042c75e0efaadfab90b926222f912e484fc4c62982fb4995578c | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 19:35

Sharing

Report Analysis Logs

General

Target

10.dll
Size

156KB
MD5

c6098b706ef69eb75633016966ac0579
SHA1

211afcb062049220e39f4915b57ed7a21d654a7d
SHA256

d4ef23361e77042c75e0efaadfab90b926222f912e484fc4c62982fb4995578c
SHA512

c05131cab725b9feed47f965c5209a9cddc4623a2cd426cf2dfedcfe53403fa29824b6b7f1d4f477c28c2a1b275c2d83e8ea3909a4e04c404e49bf04a6db8a33
SSDEEP

3072:+vUuWabpwMs+Qh1tRvEGIsV/QYVFw+pYm9EqVDJo+meNXdbrn:W7WabphKRvP5VlPw+pvHBRm2

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

45.9.74.13

Attributes

url_path
/server.php
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Signatures

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/2392-0-0x000007FEFA780000-0x000007FEFA7B0000-memory.dmp	family_strela
behavioral1/memory/2392-1-0x0000000000620000-0x0000000000642000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\10.dll
1⤵
PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-0-0x000007FEFA780000-0x000007FEFA7B0000-memory.dmp

Filesize
192KB

Download
memory/2392-1-0x0000000000620000-0x0000000000642000-memory.dmp

Filesize
136KB

Download