strela | 67a0b0f4b0cccbdba4758ec197fe3fca03ca1c30b6b626c9463ad48ede1a8581 | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 20:49

Sharing

Report Analysis Logs

General

Target

09ec10f792c2749fdc5d6ce7dc08b960N.dll
Size

215KB
MD5

09ec10f792c2749fdc5d6ce7dc08b960
SHA1

54d779663bc8354025a051bffcbf141555864a95
SHA256

67a0b0f4b0cccbdba4758ec197fe3fca03ca1c30b6b626c9463ad48ede1a8581
SHA512

6cce4af6dd7f06bc2877df46d28d91b8d45aa90f1e2ef06cd0b4718e49c97a82e7e0739054c7d95a8dcbfa6e0a5ac50b80e084b74a7fad7016db5b1bc46f42ca
SSDEEP

6144:3nPsY3Ffvh8EwP2D6duRvm2S4xDUAGp4P4OUB:/sY1fp5LjhxDUIMB

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

45.9.74.176

Attributes

url_path
/server.php
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Signatures

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/4484-0-0x00007FFF4FF80000-0x00007FFF4FFBD000-memory.dmp	family_strela
behavioral2/memory/4484-1-0x0000000002DA0000-0x0000000002DC2000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\09ec10f792c2749fdc5d6ce7dc08b960N.dll
1⤵
PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4484-0-0x00007FFF4FF80000-0x00007FFF4FFBD000-memory.dmp

Filesize
244KB

Download
memory/4484-1-0x0000000002DA0000-0x0000000002DC2000-memory.dmp

Filesize
136KB

Download