strela | 3f3e2d52ce7472ef4b6a2b28b803cf57399e41b75c0a22b2b83961cb282601ed | Triage

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 09:59

Sharing

Report Analysis Logs

General

Target

a30833f0c94689c6e9d8998582c25690N.dll
Size

248KB
MD5

a30833f0c94689c6e9d8998582c25690
SHA1

f2d698733b6897f86673c364f10ac62e2da6f41c
SHA256

3f3e2d52ce7472ef4b6a2b28b803cf57399e41b75c0a22b2b83961cb282601ed
SHA512

8dec54908169f975495ad3c22c8388778315b70c91a8fa9071e38525f780858d83e87d773933f74632949fbc20dc7c3f91a957c5f1f00bd888f48a2e05e78645
SSDEEP

6144:yvxClhO2IgWPJ3mN27FI9nxnSActFYztu4UB:yvxClk2IgWIGS9NJ+KuLB

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

45.9.74.176

Attributes

url_path
/server.php
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Signatures

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/4432-0-0x0000000002840000-0x0000000002862000-memory.dmp	family_strela
behavioral2/memory/4432-1-0x00007FFFAE220000-0x00007FFFAE265000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a30833f0c94689c6e9d8998582c25690N.dll
1⤵
PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4432-0-0x0000000002840000-0x0000000002862000-memory.dmp

Filesize
136KB

Download
memory/4432-1-0x00007FFFAE220000-0x00007FFFAE265000-memory.dmp

Filesize
276KB

Download