Overview
overview
10Static
static
3Celemony.M...up.exe
windows7-x64
10Celemony.M...up.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/bass.dll
windows7-x64
3$PLUGINSDIR/bass.dll
windows10-2004-x64
3Analysis
-
max time kernel
130s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2024 00:09
Static task
static1
Behavioral task
behavioral1
Sample
Celemony.Melodyne.Studio.4.v4.0.4.001-R2R/setup.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Celemony.Melodyne.Studio.4.v4.0.4.001-R2R/setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/bass.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/bass.dll
Resource
win10v2004-20240802-en
General
-
Target
Celemony.Melodyne.Studio.4.v4.0.4.001-R2R/setup.exe
-
Size
82.5MB
-
MD5
2b408f64508f89f31eea20586050fd85
-
SHA1
8f26ee1f0d9714dbadd99ca6d26751a35dca3dcd
-
SHA256
7c7b22145b0d6b10576d358a3eb903b642b71dcf374cb58d8a372aa23b3e4baa
-
SHA512
cfa073a656dadb8455c6b9ef535858f87c747a42021b23a83596c71220e304ea61bfe4880f7f0df96f88d2ecca22d6d3b7b9a8dfbc01bd620fb9100ffe9b9290
-
SSDEEP
1572864:m2n1DWpbcQb+1hekC/0LQJzBNEcxOrIP/YpUIHdwDVKdj0nnodsYAWbjZk:m2tWNkekDLqNEAAU4wha29sjZk
Malware Config
Signatures
-
Detects Strela Stealer payload 1 IoCs
resource yara_rule behavioral2/files/0x00070000000234a3-35.dat family_strela -
Loads dropped DLL 8 IoCs
pid Process 4204 setup.exe 4204 setup.exe 4204 setup.exe 4204 setup.exe 4204 setup.exe 4204 setup.exe 4204 setup.exe 4204 setup.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvcr71.dll setup.exe File created C:\Windows\SysWOW64\mfc71.dll setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4204 setup.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2008 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2008 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4204 setup.exe 4204 setup.exe 4204 setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celemony.Melodyne.Studio.4.v4.0.4.001-R2R\setup.exe"C:\Users\Admin\AppData\Local\Temp\Celemony.Melodyne.Studio.4.v4.0.4.001-R2R\setup.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4204
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x498 0x1501⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD589351a0a6a89519c86c5531e20dab9ea
SHA19e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
SHA256f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
SHA51213168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08
-
Filesize
5.8MB
MD52e13e03b7cf2d8c8338bbc3d29fd3e07
SHA1173e6e67c5315474765dcd303b3214d5600c48ea
SHA256ea1552de423ed1768bace344d9a07bf529845c75fe6fc6ce3c4ba91d4aae5409
SHA51294220a07aea2f4a45ef6b7566baba5a9ce73e70236bf97fc2489bee50b662f3fd05824d7804dd544eef85d73e69091aaae5de3094f0866bf51521024eb3d168d
-
Filesize
792KB
MD58fea8fd177034b52e6a5886fb5e780bd
SHA199f511388a2420d53b8406baed48ba550842eaad
SHA256546dddc7a31609b5bc3dc8ecef6f6782b77613853c54171fc32314c08a69e8de
SHA5125d82a3b9cf9d69049e6278a6d835b8a9a386c97ae9a69cf658675b0a8751a344d0da1ee704e9bb9023dab7cd77fdca684bdc90837960b583eef0bb4324498696
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
107KB
MD5c0b11a7e60f69241ddcb278722ab962f
SHA1ff855961eb5ed8779498915bab3d642044fc9bb1
SHA256a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021
SHA512cb040aca6592310bffb72c898b8eb3ca8a46ff2df50212634c637593c58683c8ab62e0188da7aea362e1b063ae5db55cf4bf474295922af0ab94a526465cc472
-
Filesize
787B
MD575a65577d878c0238f7be2611246a061
SHA17858cbb53edef3a9f8e8ba5f95961fce883245cf
SHA25658b69f563c8b84334e45884ff00c295fab7ce5b45bde2b8ffc4c4a74513645eb
SHA512e64298cc12d9a780a4f67be9f7d869e730c3580c449cdd4e0756f339874dca12ccb5ac3d8c7f2a6afe6419505d84028442acaa55aaaded7ddd4497b13abcffe0
-
Filesize
157B
MD5cc08df8486149f98cebdbeb7a6a334f9
SHA13d5d07446a74df66cbd7d4c1aefce2910662a601
SHA25676080b46dfc295ff1d82ac7f7769ed93d854b5b05376fbf666d9b7cbe3ab2c15
SHA512ebedb3c57b2571c75f7fefde7bdc3b60afc4518a3f4ad4fd05b0930c7bb16d7a62bbe75c7a3a52f36e745406c5cf36063197a409d75bc0092cd5202f7fb0dede
-
Filesize
1.0MB
MD51fd3f9722119bdf7b8cff0ecd1e84ea6
SHA19a4faa258b375e173feaca91a8bd920baf1091eb
SHA256385ea2a454172e3f9b1b18778d4d29318a12be9f0c0c0602db72e2cce136e823
SHA512109d7a80a5b10548200d05ab3d7deb9dc2ae8e40d84b468184895eb462211078ecdcb11f01eb50c91c65a924f8e592cd63b78e402dcaea144ff89c11f2ab07d6
-
Filesize
340KB
MD5ca2f560921b7b8be1cf555a5a18d54c3
SHA1432dbcf54b6f1142058b413a9d52668a2bde011d
SHA256c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
SHA51223e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e