Overview
overview
10Static
static
31500.dll
windows7-x64
101500.dll
windows10-2004-x64
101501.dll
windows7-x64
101501.dll
windows10-2004-x64
101502.dll
windows7-x64
101502.dll
windows10-2004-x64
101503.dll
windows7-x64
101503.dll
windows10-2004-x64
101504.dll
windows7-x64
101504.dll
windows10-2004-x64
101505.dll
windows7-x64
101505.dll
windows10-2004-x64
101506.dll
windows7-x64
101506.dll
windows10-2004-x64
101507.dll
windows7-x64
101507.dll
windows10-2004-x64
101508.dll
windows7-x64
101508.dll
windows10-2004-x64
101509.dll
windows7-x64
101509.dll
windows10-2004-x64
101510.dll
windows7-x64
101510.dll
windows10-2004-x64
101511.dll
windows7-x64
101511.dll
windows10-2004-x64
101512.dll
windows7-x64
101512.dll
windows10-2004-x64
101513.dll
windows7-x64
101513.dll
windows10-2004-x64
101514.dll
windows7-x64
101514.dll
windows10-2004-x64
101515.dll
windows7-x64
101515.dll
windows10-2004-x64
10Analysis
-
max time kernel
91s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 08:34 UTC
Static task
static1
Behavioral task
behavioral1
Sample
1500.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1500.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
1501.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
1501.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
1502.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
1502.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
1503.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
1503.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
1504.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
1504.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
1505.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
1505.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
1506.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
1506.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
1507.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
1507.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
1508.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
1508.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
1509.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
1509.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
1510.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
1510.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
1511.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
1511.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
1512.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
1512.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
1513.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
1513.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
1514.dll
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
1514.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
1515.dll
Resource
win7-20240704-en
General
-
Target
1514.dll
-
Size
123KB
-
MD5
09bc9788d1d85a131b9e76e2f7ecf9da
-
SHA1
18e2670b8b9d0ef333154c9d60c32d87f6660bb4
-
SHA256
4c259f5615da5da26edebd3feac569bcb44eb1a239aeed7006a507a81a6e8f50
-
SHA512
be61c333c29c38d86717f5d3067083c9bfa475d3f7596e6fa9664312488f8a34139cecacc39ed4de75616e4e660c8b474eb5dabb19f173c35a20a91c4745ccab
-
SSDEEP
3072:ydBTv/ftSW7PhfWaeWSmpXYOg2NbB1Q2/qHlBzMNSfb3:ITv1x0WSmpNf1QzHlZp3
Malware Config
Extracted
strela
45.9.74.32
-
url_path
/out.php
-
user_agent
Mozilla/4.0 (compatible)
Signatures
-
Detects Strela Stealer payload 2 IoCs
resource yara_rule behavioral30/memory/2032-0-0x000001FDEBBF0000-0x000001FDEBC12000-memory.dmp family_strela behavioral30/memory/2032-1-0x000001FDEBBF0000-0x000001FDEBC12000-memory.dmp family_strela
Processes
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A204.79.197.237dual-a-0034.a-msedge.netIN A13.107.21.237
-
Remote address:8.8.8.8:53Request4.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request237.197.79.204.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request107.12.20.2.in-addr.arpaIN PTRResponse107.12.20.2.in-addr.arpaIN PTRa2-20-12-107deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.23713.107.21.237
-
73 B 143 B 1 1
DNS Request
237.197.79.204.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
4.159.190.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
107.12.20.2.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa