Resubmissions

13/07/2024, 11:14 UTC

240713-ncevfazhpa 10

13/07/2024, 10:54 UTC

240713-mzz88axhkm 3

Analysis

  • max time kernel
    120s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 11:14 UTC

General

  • Target

    973.dll

  • Size

    123KB

  • MD5

    87ac86623e96d673472e838b3bc48e33

  • SHA1

    035b8dd39473fffb0869e5b7829248c8981eae9d

  • SHA256

    37601fb25945d5f447c47f82f9da282b01e37a8c3f8a7d1c60d5cb897df83557

  • SHA512

    99acca21544ed3ea9a89d6c4753a6e60197ffb7146d531d0adda798b5e2157934a168e454e35e66e8145386b1ea2a9bb455ab3b9440ab5446d051fa1b4860891

  • SSDEEP

    3072:a2P3pGOntvREZxgNb546z2gU+IODKZQS9YeSbSD7JV:PP3pGOnt+ZxStTEWUQ0Y4D3

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Signatures

  • Detects Strela Stealer payload 1 IoCs
  • Strela stealer

    An info stealer targeting mail credentials first seen in late 2022.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\973.dll,#1
    1⤵
      PID:340

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/340-0-0x00000000001E0000-0x0000000000202000-memory.dmp

      Filesize

      136KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.