strela | b3d768ea03a96e24f685e30258501131bd9685a894c49ccb3918b4f38f0733e6 | Triage

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 11:43

Sharing

Report Analysis Logs

General

Target

501.dll
Size

124KB
MD5

114c8c3f0806a330dc7474ce58868376
SHA1

8bbbd29ec944edc87a004126e9e35b1ab0df746d
SHA256

8490403401fb7626c1d7866be29025cdc476f6269770892b99afe2478de9bcab
SHA512

0bdc5d385d589e24e6aea5cf08eee4c58074089e869adf1ecd1fb449b7f06e98012931dd2c0277b24cc9a547272fd8590f02e285b13a3dca461d9f67e07dd9ce
SSDEEP

3072:+Me6tb/Gt5Wjniy7jLbQ4bmq3IIHyxDNyXJ/30rUniT:+Me6tb/9m4VicxS2Xlzn

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes

url_path
/out.php
user_agent
Mozilla/4.0 (compatible)

Signatures

Detects Strela Stealer payload 1 IoCs

resource	yara_rule
behavioral3/memory/3016-0-0x0000000000150000-0x0000000000172000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\501.dll,#1
1⤵
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x0000000000150000-0x0000000000172000-memory.dmp

Filesize
136KB

Download