Resubmissions

13/07/2024, 11:14 UTC

240713-ncevfazhpa 10

13/07/2024, 10:54 UTC

240713-mzz88axhkm 3

Analysis

  • max time kernel
    121s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 11:14 UTC

General

  • Target

    974.dll

  • Size

    124KB

  • MD5

    a17d52191d396362580d72e265bdcfa1

  • SHA1

    fa4cbe9136d09cd6edfda53d5c987adcaefe8a37

  • SHA256

    034384403472d88a5c383905be0426b4dafd45c8166c3f962b67a7cdacc48bd0

  • SHA512

    8ca4c00491da5cc3506c860bf825073347998317f238cd927627d027573a5f5b15e85dfe4dbff4ac6eaba1160a9b0d9a5ac7d4861dce04e844e794d47ca97f74

  • SSDEEP

    3072:Ik0jlB6BiQR9z9XNbquKbeh8KOcfbCEfdV2Q0urNDp:+EiQ/z9XIgh8KOcfbC+h

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Signatures

  • Detects Strela Stealer payload 1 IoCs
  • Strela stealer

    An info stealer targeting mail credentials first seen in late 2022.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\974.dll,#1
    1⤵
      PID:2312

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2312-0-0x0000000000150000-0x0000000000172000-memory.dmp

      Filesize

      136KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.