Resubmissions

13/07/2024, 11:14 UTC

240713-ncevfazhpa 10

13/07/2024, 10:54 UTC

240713-mzz88axhkm 3

Analysis

  • max time kernel
    119s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 11:14 UTC

General

  • Target

    98.dll

  • Size

    124KB

  • MD5

    cfac3393711c2f8cffe9a49bc3d1b64b

  • SHA1

    8beaea638fd20c857f114530296f037f15586352

  • SHA256

    c4cfd311c0f2999f570bf3c237eb14de6aa0f8c6b0756ecd58c34f5c934c5a58

  • SHA512

    fb34a6e619a473fb43516f1c965787527b37389a61470e5d21bc8b1150759e486dea00d362f35e5d57f8c644b41b95014fc33cd6bd5eb3dbbb25b7400321c6da

  • SSDEEP

    3072:qZi6OvBmFEViFRdHifmnJNUY5LpWJq8NTQslmEelh+UZ:qc9BuYibdHwmjWq6QGU

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Signatures

  • Detects Strela Stealer payload 1 IoCs
  • Strela stealer

    An info stealer targeting mail credentials first seen in late 2022.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\98.dll,#1
    1⤵
      PID:2856

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2856-0-0x0000000000160000-0x0000000000182000-memory.dmp

      Filesize

      136KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.