Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 21:29 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
233ce5fa53e7ee9e7453d84f9ebba950N.dll
Resource
win7-20240708-en
2 signatures
120 seconds
General
-
Target
233ce5fa53e7ee9e7453d84f9ebba950N.dll
-
Size
123KB
-
MD5
233ce5fa53e7ee9e7453d84f9ebba950
-
SHA1
4d536a8d72d0f692a4c6ecf55a83663684bbae62
-
SHA256
ef88620004764da5f8e9986d79414c4ece0e8419e0e6bba6e6a973e33494bfc7
-
SHA512
bebed5e111dc290c26e26ccbdc3d1c327fd1066e98008f76f2468055e8458487c21603e85e76809ca3cf610aa4fb191ff37b10e42ec8133c5a3a1fdf31670200
-
SSDEEP
1536:6rIVzaXytQW+yCOheFuJPb+SXqabMILrRdOepm4UwD8N/A3cyLZmbQ/LY+qsnoKf:PV+IFYFuh+exLrRZfUS0bDknToKAQv7
Malware Config
Extracted
Family
strela
C2
45.9.74.32
Attributes
-
url_path
/out.php
-
user_agent
Mozilla/4.0 (compatible)
Signatures
-
Detects Strela Stealer payload 2 IoCs
resource yara_rule behavioral2/memory/2948-0-0x000001D756460000-0x000001D756482000-memory.dmp family_strela behavioral2/memory/2948-1-0x000001D756460000-0x000001D756482000-memory.dmp family_strela
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request68.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request100.58.20.217.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
No results found
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
68.159.190.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 132 B 1 1
DNS Request
100.58.20.217.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa