strela | ae1c457e4968758551c0e99ce62cb87c02b6c134afda6d1d700da3b37a2d7610

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CB_setup.exe
Size 21.4MB
Sample240728-2s976stenb
SHA256 ae1c457e4968758551c0e99ce62cb87c02b6c134afda6d1d700da3b37a2d7610
MD5 193642adb57aec509ba3fd698a09efd2
SHA1 d9166b6ac1c069f028188357ff40256d7395868c
SHA512 507c9698f6d9b2def0f60641b5eeef5a13a55f0a492af62abae7345b9b01d3cef490a689ff98fe899b2188cb4d3d74b1a655dccf370f31d01ca7fbca2041bc5e
SSDEEP 393216:Es5Q1AuX1FFetKFOfzJyb2omyUw7RLo4WRsyo1fL79UXPj5MXHQqkJGlF:Es52AuXHQagzJk+yUwBo5oHUXPFkQ3K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela discovery stealer

Malware Config

Signatures

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00050000000195cc-67.dat	family_strela
behavioral1/memory/2280-68-0x0000000005360000-0x000000000592D000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Loads dropped DLL 9 IoCs

pid	Process
2280	CB_setup.exe
2280	CB_setup.exe
2280	CB_setup.exe
2280	CB_setup.exe
2280	CB_setup.exe
2280	CB_setup.exe
2280	CB_setup.exe
2280	CB_setup.exe
2280	CB_setup.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gdiplus.dll	CB_setup.exe
File created	C:\Windows\SysWOW64\msvcr71.dll	CB_setup.exe
File created	C:\Windows\SysWOW64\mfc71.dll	CB_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB_setup.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	CB_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CB_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CB_setup.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2280	CB_setup.exe
2280	CB_setup.exe
2280	CB_setup.exe

C:\Users\Admin\AppData\Local\Temp\CB_setup.exe
"C:\Users\Admin\AppData\Local\Temp\CB_setup.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CabB84C.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabB84C.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarBB6B.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarBB6B.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

version_free.ini

Path C:\Users\Admin\AppData\Local\Temp\version_free.ini
Size 15KB
SHA256 69efb45ca18fe1c109e6a24ff4f8c5e0a17ff8b5e196710046bdd0d4917e25f0
MD5 80bc7fa432a388ae762c0448abfaf3f1
SHA1 f268dd816fb9a102b49389420ab7f80b4ac44f8a
SHA512 adcab8a19d205919aa13a226b45d8e64e0964bff9a7925730f66c37437411cc6573298574b27d4330224987fc23d74b2a000845e370a28d15fe920f8b6304bd4
SSDEEP 192:A/bkVq0u7m4qlqGmY8DanZ+FhntjCIyhU7mk:AgU0UsLGanZijCIyhs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Banner.dll

Path \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\Banner.dll
Size 3KB
SHA256 045bd54299e1cf2d9e68f64e233f30c8a2c455d72645d4a4a9ca8874a7c510ac
MD5 4a90d392c9da5f0b90a75baf67c37e4c
SHA1 73e875dafefaa16def7f77a428a5c131b7b9837e
SHA512 82014b8fb94da3d158ef68a2488eb594bcf27d31132b4bbf2f4c441d00ed9d374d78cd013a1af6c59fd03716bf5c429cddf77c43e1e171df24086b70b7b9a13d
MD5 SHA1 SHA512

Submit Download

MyLangDLLS3.dll

Path \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\MyLangDLLS3.dll
Size 5KB
SHA256 dfca83b19ee2fe36479e9c1ceef2eb45b08851236dcf7a958141b1af03d27a21
MD5 7050cd061f2ddac010e3382a57d5ede4
SHA1 a0a1e5e89fb230dfa3c76ee15b0e51abead32282
SHA512 5f8472dd37a1cc1aecad78610b71670989715a15f8911e658ce7da4c4b2d428f866c9e61df30f6660d91dd365b1c055676ef3a3f6ec77d826ef11175a713455e
SSDEEP 48:aYZvMWeApYxYlxamAWHN+EuWkGWBBWAGr9SdLB8mT/59DvZVSA:JyWGSxamjHNDuWRWBBWvmT//RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSIS_SkinCrafter_Plugin.dll

Path \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\NSIS_SkinCrafter_Plugin.dll
Size 5.8MB
SHA256 ea1552de423ed1768bace344d9a07bf529845c75fe6fc6ce3c4ba91d4aae5409
MD5 2e13e03b7cf2d8c8338bbc3d29fd3e07
SHA1 173e6e67c5315474765dcd303b3214d5600c48ea
SHA512 94220a07aea2f4a45ef6b7566baba5a9ce73e70236bf97fc2489bee50b662f3fd05824d7804dd544eef85d73e69091aaae5de3094f0866bf51521024eb3d168d
SSDEEP 98304:eF0Kg9frmFcqlMZ4vpHfOVlQnzW4Aogn/oXFdAaTZ8GcB7d0:eFFA7t2RHfYlQZJgTamGcBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Plugin.dll

Path \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\Plugin.dll
Size 2.1MB
SHA256 ea847b3e559321f8825d4339ad503b8082546ad7f9ae1d8373914f2ffaf3e6a2
MD5 67ad13de4800015f22cffaa96e1cdd41
SHA1 542fb5baeea3f3b7ebdc70061790612ae9bfd0dc
SHA512 c2f776d6b4091dcc241ca25d3d1134f7487f6ffd1e58b6108d3dae655cdb949c3ded8a03a952ec33947c61cb0213fde25b79992ca86327e380f30140a881a79b
SSDEEP 49152:sLiFc4XSrTu9TCEl/EswofHbTdTqTDvqPe:IiFc4XSrOHE8fHPe
MD5 SHA1 SHA512 SSDEEP

Submit Download

SkinCrafter.dll

Path \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\SkinCrafter.dll
Size 792KB
SHA256 546dddc7a31609b5bc3dc8ecef6f6782b77613853c54171fc32314c08a69e8de
MD5 8fea8fd177034b52e6a5886fb5e780bd
SHA1 99f511388a2420d53b8406baed48ba550842eaad
SHA512 5d82a3b9cf9d69049e6278a6d835b8a9a386c97ae9a69cf658675b0a8751a344d0da1ee704e9bb9023dab7cd77fdca684bdc90837960b583eef0bb4324498696
SSDEEP 6144:k8tdVR1oDmqv3v8nt61NnE1wvVwRqXq/wS2GWx5bq8OudNaVTpBopxAzr8TBlehD:Db1oDHv3SONfvV0MLraVNBopq8T3Pq
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\System.dll
Size 11KB
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\UserInfo.dll
Size 4KB
SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
MD5 d16e06c5de8fb8213a0464568ed9852f
SHA1 d063690dc0d2c824f714acb5c4bcede3aa193f03
SHA512 60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a
MD5 SHA1 SHA512

Submit Download

mfc71.dll

Path \Windows\SysWOW64\mfc71.dll
Size 1.0MB
SHA256 385ea2a454172e3f9b1b18778d4d29318a12be9f0c0c0602db72e2cce136e823
MD5 1fd3f9722119bdf7b8cff0ecd1e84ea6
SHA1 9a4faa258b375e173feaca91a8bd920baf1091eb
SHA512 109d7a80a5b10548200d05ab3d7deb9dc2ae8e40d84b468184895eb462211078ecdcb11f01eb50c91c65a924f8e592cd63b78e402dcaea144ff89c11f2ab07d6
SSDEEP 24576:jz4AxCLo/XFdAaBxZrJ+Gc10CXiTEd1aE3w:UuXFdAaBxZ8GcFXiTEd0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr71.dll

Path \Windows\SysWOW64\msvcr71.dll
Size 340KB
SHA256 c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
MD5 ca2f560921b7b8be1cf555a5a18d54c3
SHA1 432dbcf54b6f1142058b413a9d52668a2bde011d
SHA512 23e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e
SSDEEP 6144:cPlV59g81QWguohIP/siMbo8Crn2zzwRFMciFMNrb3YgxS3bCAO5kkG:OlVvN1QWguohInJDrn8zwNF7eCr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2280-68-0x0000000005360000-0x000000000592D000-memory.dmp

Download

memory/2280-76-0x0000000005260000-0x000000000532C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads