Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-07-2024 12:04

General

  • Target

    c3a84e6d62e9bbceb174bc16dde6f5762625d946a8e717aa29c2d4d83c47ff66.dll

  • Size

    124KB

  • MD5

    382e84e3e93ef0983fd11df4d27daa1e

  • SHA1

    33987b2128f883a0368c2c32341b0c1ec942a5ec

  • SHA256

    c3a84e6d62e9bbceb174bc16dde6f5762625d946a8e717aa29c2d4d83c47ff66

  • SHA512

    20101f6b59d60ea8c69120b9f3f4e785e80f5decdb7e933dfe29299666f1ea4f82d849b64fa780867370b6fd8049697e6ababe8671446ccc6d7a3de8da2ddd8e

  • SSDEEP

    3072:kQ4/1etoltBt5SpRfoY6XAFHZJq2uuR89gaBh3cOk:kQ4/gtqtBayA1ZW9jBh3c

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Signatures

  • Detects Strela Stealer payload 1 IoCs
  • Strela stealer

    An info stealer targeting mail credentials first seen in late 2022.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3a84e6d62e9bbceb174bc16dde6f5762625d946a8e717aa29c2d4d83c47ff66.dll,#1
    1⤵
      PID:1144

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      25.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      25.173.189.20.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      138 B
      248 B
      2
      2

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      25.173.189.20.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1144-0-0x000001F758090000-0x000001F7580B2000-memory.dmp

      Filesize

      136KB

    • memory/1144-1-0x000001F758090000-0x000001F7580B2000-memory.dmp

      Filesize

      136KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.