strela | af0247bc7703ee4f903391f5f257caa789942aa6c37adbbe9ee790b412dbb138

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 03:45

Target
27b87bbd8a5f520974c98657b08967c0N.dll
Size 156KB
Sample240709-ea4aksxarf
SHA256 af0247bc7703ee4f903391f5f257caa789942aa6c37adbbe9ee790b412dbb138
MD5 27b87bbd8a5f520974c98657b08967c0
SHA1 7d84f2cc7afc50e6c52302f54eeaf62ca53b18f1
SHA512 39395cce9d6c86deabf1cd680a5c7ded988a29e4720c4f9e7ac1d80333c05570e0a8f41ab2bad5cf2daa350267a1aa2f64cabfb02c40d753b42d9578a8523805
SSDEEP 3072:PqqSxrovI9uPJtN2U+8MHvThqjxM4kcFNF+cB6hO6GlehwnSBPKbvo69pr2:9SdcPEUOHLs24dWcP/cKCKbwko
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela stealer

Family

Attributes

url_path
/server.php
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/4928-0-0x00007FFB83940000-0x00007FFB83970000-memory.dmp	family_strela
behavioral2/memory/4928-1-0x00000000028A0000-0x00000000028C2000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\27b87bbd8a5f520974c98657b08967c0N.dll
1⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3856,i,7362247189940554640,1583793531684159627,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:3436

memory/4928-0-0x00007FFB83940000-0x00007FFB83970000-memory.dmp

Download

memory/4928-1-0x00000000028A0000-0x00000000028C2000-memory.dmp

Download