Overview
overview
10Static
static
33500.dll
windows7-x64
103500.dll
windows10-2004-x64
103501.dll
windows7-x64
103501.dll
windows10-2004-x64
103502.dll
windows7-x64
103502.dll
windows10-2004-x64
103503.dll
windows7-x64
103503.dll
windows10-2004-x64
103504.dll
windows7-x64
103504.dll
windows10-2004-x64
103505.dll
windows7-x64
103505.dll
windows10-2004-x64
103506.dll
windows7-x64
103506.dll
windows10-2004-x64
103507.dll
windows7-x64
103507.dll
windows10-2004-x64
103508.dll
windows7-x64
103508.dll
windows10-2004-x64
103509.dll
windows7-x64
103509.dll
windows10-2004-x64
103510.dll
windows7-x64
103510.dll
windows10-2004-x64
103511.dll
windows7-x64
103511.dll
windows10-2004-x64
103512.dll
windows7-x64
103512.dll
windows10-2004-x64
103513.dll
windows7-x64
103513.dll
windows10-2004-x64
103514.dll
windows7-x64
103514.dll
windows10-2004-x64
103515.dll
windows7-x64
103515.dll
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 12:05 UTC
Static task
static1
Behavioral task
behavioral1
Sample
3500.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3500.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
3501.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
3501.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
3502.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
3502.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
3503.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
3503.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
3504.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
3504.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
3505.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
3505.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
3506.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
3506.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
3507.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
3507.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
3508.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
3508.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
3509.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
3509.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
3510.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
3510.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
3511.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
3511.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
3512.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
3512.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
3513.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
3513.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
3514.dll
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
3514.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
3515.dll
Resource
win7-20240708-en
General
-
Target
3510.dll
-
Size
123KB
-
MD5
edd7247f66d7fca79ef6b6d34d461fed
-
SHA1
699211199c94456eedaca7c25b404a0772ec6733
-
SHA256
8aa4e50343ea413f4a564385ce86ab3e1b35a7f4753ca49a4da87cad026bb082
-
SHA512
c997a64d9da890bad9d8ea976de826d09b535d6769d15545d59e9b80c25366338f4d4bb35173fb9705f5cf8a8602c24f700e55ff815f49139f08ea1c8122f75a
-
SSDEEP
3072:SmAkjU1OFvg0qUBQh+tBscT9HGLE4TjPxzZXjvzd5:S3kRvgUNBsvjPhZXd
Malware Config
Extracted
strela
45.9.74.32
-
url_path
/out.php
-
user_agent
Mozilla/4.0 (compatible)
Signatures
-
Detects Strela Stealer payload 2 IoCs
resource yara_rule behavioral22/memory/1360-0-0x000001FDEFE20000-0x000001FDEFE42000-memory.dmp family_strela behavioral22/memory/1360-1-0x000001FDEFE20000-0x000001FDEFE42000-memory.dmp family_strela
Processes
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
76.32.126.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa