Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15/07/2024, 03:53 UTC
General
-
Target
779dfd61b316a0feb2eec7303cb7b680N.dll
-
Size
125KB
-
MD5
779dfd61b316a0feb2eec7303cb7b680
-
SHA1
ca0cbb6d5c07907820322f69465a7623f747bd0b
-
SHA256
7a2056aed65668d603092e58860e2f8afea173c1399d020f31e87e590ab65392
-
SHA512
81b538197b8e99e0247121311680fe98fee170537835bad861a56660a3e708eeb3588be2fcc59ba14fcf8b3dfd0d3ea7a8714d2a16b439def35caf027aa55938
-
SSDEEP
3072:RwfE6hGYrNo9+lHm+Ld27Y7gWsTYG1t52gr:SbJry9MLkmgWfGBDr
Score
10/10
Malware Config
Extracted
Family
strela
C2
45.9.74.32
Attributes
-
url_path
/out.php
-
user_agent
Mozilla/4.0 (compatible)
Signatures
-
Detects Strela Stealer payload 2 IoCs
-
Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\779dfd61b316a0feb2eec7303cb7b680N.dll,#11⤵
Network
-
DNS134.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request134.32.126.40.in-addr.arpaIN PTRResponse -
DNS26.35.223.20.in-addr.arpaRemote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS81.144.22.2.in-addr.arpaRemote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
DNS31.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:53134.32.126.40.in-addr.arpadns
DNS Request
134.32.126.40.in-addr.arpa
-
8.8.8.8:5326.35.223.20.in-addr.arpadns
DNS Request
26.35.223.20.in-addr.arpa
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:5381.144.22.2.in-addr.arpadns
DNS Request
81.144.22.2.in-addr.arpa
-
8.8.8.8:5331.243.111.52.in-addr.arpadns
DNS Request
31.243.111.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
-
Filesize
136KB