Resubmissions

13/07/2024, 11:14 UTC

240713-ncevfazhpa 10

13/07/2024, 10:54 UTC

240713-mzz88axhkm 3

Analysis

  • max time kernel
    13s
  • max time network
    56s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 11:14 UTC

General

  • Target

    983.dll

  • Size

    123KB

  • MD5

    8367687d479ea4d71e74410a426c37a2

  • SHA1

    3677bb17775d2f9536d13a04a0457d703e0a1409

  • SHA256

    ef48521a1f0fe87d51e91efa5b5d104c32eb058c498d373e07844e0308a9ad67

  • SHA512

    164524d76338a906f4934ffb035dd40f77dd120bf8f6f1ea4eb96c4b7b0aedfced38f761b8d217fe3af3915db3388162234ea3804966d8b502095022c05d0fe5

  • SSDEEP

    3072:ha5865DrRNwgX34HosbWT5zne4pJ/ak7:haa6VTBYIsbmVJ/a

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Signatures

  • Detects Strela Stealer payload 2 IoCs
  • Strela stealer

    An info stealer targeting mail credentials first seen in late 2022.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\983.dll,#1
    1⤵
      PID:1152

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1152-0-0x0000000000300000-0x0000000000322000-memory.dmp

      Filesize

      136KB

    • memory/1152-1-0x0000000000300000-0x0000000000322000-memory.dmp

      Filesize

      136KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.