strela | 698a7d658757e4b9d118a181f798807830235599b0500a6e5f6914d7e3e7879b | Triage

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 02:25

Sharing

Report Analysis Logs

General

Target

515e390cb93c80752375a813025f6970N.dll
Size

211KB
MD5

515e390cb93c80752375a813025f6970
SHA1

871dec16b35a85268498a345b7ea2f86fccb0aba
SHA256

698a7d658757e4b9d118a181f798807830235599b0500a6e5f6914d7e3e7879b
SHA512

477b333c3178dd37dd7860cf803a79e46fc894403e8c41da02b2a4037be79aeaaab0e76455c15d1294c7bcb64ad70693ed734eb0153ee8f9e304197efc165781
SSDEEP

6144:C5VSq+kYMTk87rbo56RFq+fnZ4YBHBSUB:CjpPTjHbP53HfB

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

45.9.74.176

Attributes

url_path
/server.php
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Signatures

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/4632-0-0x0000000002F60000-0x0000000002F82000-memory.dmp	family_strela
behavioral2/memory/4632-1-0x00007FF847480000-0x00007FF8474BC000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\515e390cb93c80752375a813025f6970N.dll
1⤵
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4632-0-0x0000000002F60000-0x0000000002F82000-memory.dmp

Filesize
136KB

Download
memory/4632-1-0x00007FF847480000-0x00007FF8474BC000-memory.dmp

Filesize
240KB

Download