strela | 1c295d214cbe21101cc4aa71c375bc27877a5964ec1183c4b6d8c8c6a180fb66 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 19:26

Sharing

Report Analysis Logs

General

Target

0f974f079db1cd61d4e5e4354a4f4dc0N.dll
Size

251KB
MD5

0f974f079db1cd61d4e5e4354a4f4dc0
SHA1

825841df754fcf74af892ad04c723ac5904542ca
SHA256

1c295d214cbe21101cc4aa71c375bc27877a5964ec1183c4b6d8c8c6a180fb66
SHA512

91ff116bfc41726e2b3c6677ec4b6ddbb719f5e536610ad41176fb94fd780efffdf77f8679469a874f02f539ba58e71393ab218d9bcfa4c79e11a952f2583e85
SSDEEP

6144:vx4lS4s6jOSpevZSbfgfdaXp2b3LuYWeRAw+UB:vxKsvsbfOb3LyeRA8B

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

45.9.74.176

Attributes

url_path
/server.php
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Signatures

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/332-0-0x000007FEF7140000-0x000007FEF7186000-memory.dmp	family_strela
behavioral1/memory/332-1-0x0000000000500000-0x0000000000522000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0f974f079db1cd61d4e5e4354a4f4dc0N.dll
1⤵
PID:332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-0-0x000007FEF7140000-0x000007FEF7186000-memory.dmp

Filesize
280KB

Download
memory/332-1-0x0000000000500000-0x0000000000522000-memory.dmp

Filesize
136KB

Download