strela | f53c6c1b5f24d522458971a2457ed4333a458fe8a9017b5eb9ec538714f5aa9b | Triage

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 10:41

Sharing

Report Analysis Logs

General

Target

c76f34682f03703ac64eefd849693260N.dll
Size

212KB
MD5

c76f34682f03703ac64eefd849693260
SHA1

2a982e484e6dc1c55e1350034778bdab5f76d293
SHA256

f53c6c1b5f24d522458971a2457ed4333a458fe8a9017b5eb9ec538714f5aa9b
SHA512

57dd42faa118b93663861aafd278dd29b61cba45115b869d79eb717e7c4e98a1eb208ad23b9f9f4914ecd6cced2ae1720324bd31d6ba55322d5c173292591762
SSDEEP

6144:5wAUdAojBOh+aOR2UCbGETiZMsFAT08sYPz1mFUB:5w2iBQDo389K2L3B

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

45.9.74.176

Attributes

url_path
/server.php
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Signatures

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/3424-0-0x00007FFB52390000-0x00007FFB523CC000-memory.dmp	family_strela
behavioral2/memory/3424-1-0x0000000002D60000-0x0000000002D82000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c76f34682f03703ac64eefd849693260N.dll
1⤵
PID:3424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3424-0-0x00007FFB52390000-0x00007FFB523CC000-memory.dmp

Filesize
240KB

Download
memory/3424-1-0x0000000002D60000-0x0000000002D82000-memory.dmp

Filesize
136KB

Download