strela | InstallWizard101[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
InstallWizard101.exe
Size 26.0MB
Sample240831-d23yfstdkq
SHA256 6b57197633273a41a53c14121504f89f1134bb1ca30166f4eefa3808bfbf75e2
MD5 2ec7ca56b024233004ef3f59f287a3cd
SHA1 629b419b966f043ebde271ad9ce9fd0a9ccc0cec
SHA512 c5a7e97a5e2c7537b6d55c1f1cf4f970986850562e727f73d34d7c25decda0689abda6ef5072a9ad0eb98b777bb844f8427a345fbd6df8811a71443cf85c40cc
SSDEEP 786432:GKRTcqIr+TUW48OpddotcwMA/gZpL2DAbyHo/Qq+c0j5m2WF7f:+qI6Tx6qtc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela

Malware Config

Signatures

Detects Strela Stealer payload 1 IoCs

resource	yara_rule
sample	family_strela

Strela family
strela

File Explorer

InstallWizard101.exe

.exe 26.0MB

InstallWizard101.exe

IMPHASH 5fca7f0fc8c16d55fed0e805fc0ad295
SHA256 6b57197633273a41a53c14121504f89f1134bb1ca30166f4eefa3808bfbf75e2
MD5 2ec7ca56b024233004ef3f59f287a3cd
SHA1 629b419b966f043ebde271ad9ce9fd0a9ccc0cec
SHA512 c5a7e97a5e2c7537b6d55c1f1cf4f970986850562e727f73d34d7c25decda0689abda6ef5072a9ad0eb98b777bb844f8427a345fbd6df8811a71443cf85c40cc
SSDEEP 786432:GKRTcqIr+TUW48OpddotcwMA/gZpL2DAbyHo/Qq+c0j5m2WF7f:+qI6Tx6qtc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects Strela Stealer payload

Digest

1f:82:e2:3f:06:58:c4:af:7f:b0:a0:7f:45:63:25:49:aa:1e:d2:96

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=KingsIsle Entertainment Inc.,OU=Game Services,O=KingsIsle Entertainment Inc.,L=Plano,ST=Texas,C=US

Chains

Nov 12, 2019

CN=KingsIsle Entertainment Inc.,OU=Game Services,O=KingsIsle Entertainment Inc.,L=Plano,ST=Texas,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

Major OS version

Entry point

138980

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

GetSystemInfo CreateFileMappingA VirtualQuery CompareStringA CreateDirectoryA GetFileSize LoadLibraryExA CompareStringW GlobalSize FreeResource VirtualFree GetCurrentProcess HeapDestroy DuplicateHandle GetThreadContext VirtualProtectEx WriteProcessMemory FlushInstructionCache SetThreadContext ResumeThread GetLastError MapViewOfFile DeleteFileA RemoveDirectoryA MultiByteToWideChar WideCharToMultiByte lstrlenW CreateProcessA CloseHandle Sleep lstrlenA UnmapViewOfFile IsBadReadPtr ReadFile FindFirstFileA FindClose lstrcmpiA lstrcpynA WriteFile GetDriveTypeA SetFilePointer GetFileAttributesA GetPrivateProfileIntA CreateEventA QueryPerformanceFrequency lstrcatA ReleaseMutex GetSystemDefaultLangID CreateMutexA SetErrorMode GetSystemDirectoryA MulDiv GetPrivateProfileStringA GetPrivateProfileSectionNamesA FlushFileBuffers SetStdHandle LoadLibraryA FreeLibrary GetDiskFreeSpaceA GetTickCount FindResourceExA GetWindowsDirectoryA InterlockedDecrement LocalFree InterlockedIncrement FormatMessageA GetTempPathA GetVersionExA CreateFileA GlobalFree FindResourceA LoadResource SizeofResource GlobalAlloc LockResource GlobalLock GlobalUnlock WaitForSingleObject SetLastError ExitProcess lstrcpyA GetModuleFileNameA GetModuleHandleA GetProcAddress HeapCreate IsBadCodePtr GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetEnvironmentVariableA TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId GetOEMCP GetACP GetCPInfo GetCommandLineA GetStartupInfoA RaiseException HeapAlloc HeapFree RtlUnwind UnhandledExceptionFilter GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter HeapSize LCMapStringW LCMapStringA IsBadWritePtr HeapReAlloc SearchPathA FindNextFileA GetTempFileNameA GetExitCodeProcess OpenProcess CompareFileTime GetProcessTimes TerminateProcess GetLocalTime InitializeCriticalSection GetCurrentProcessId GetVersion LeaveCriticalSection EnterCriticalSection GetCurrentThread VirtualProtect ResetEvent SetEvent QueryPerformanceCounter SystemTimeToFileTime lstrcmpA MoveFileExA InterlockedExchange DeleteCriticalSection VirtualAlloc

user32

WaitForInputIdle CharUpperA wsprintfA MessageBoxA DialogBoxIndirectParamA SetDlgItemTextA SetWindowLongA SetFocus BeginPaint EndPaint LoadStringA FillRect ScreenToClient SendDlgItemMessageA GetMessageA DefWindowProcA GetParent GetWindow SystemParametersInfoA MsgWaitForMultipleObjects GetWindowDC UpdateWindow InvalidateRect DrawIcon MapDialogRect GetClassNameA CallWindowProcA DrawFocusRect InflateRect DrawTextA GetWindowTextA CopyRect EnumChildWindows CreateWindowExA RegisterClassExA IntersectRect GetDlgItemTextA MapWindowPoints SetWindowPos GetPropA EnableMenuItem SetPropA RemovePropA ShowWindow IsWindow GetSysColor LoadImageA CreateDialogParamA GetDC ReleaseDC SetActiveWindow PeekMessageA IsDialogMessageA TranslateMessage DispatchMessageA DestroyWindow CreateDialogIndirectParamA SetForegroundWindow GetDesktopWindow GetClientRect EnableWindow IsWindowEnabled GetWindowLongA GetWindowRect MoveWindow EndDialog LoadIconA GetDlgItem SendMessageA SetWindowTextA

gdi32

SetBkMode SetTextColor TextOutA RestoreDC CreateFontIndirectA SetBkColor CreateRectRgn DeleteObject CreateSolidBrush GetDIBColorTable GetSystemPaletteEntries CreatePalette CreateHalftonePalette GetDeviceCaps GetObjectA CreateCompatibleDC UnrealizeObject SelectPalette RealizePalette SelectObject BitBlt DeleteDC CreateDIBitmap CreateCompatibleBitmap CreateDCA GetStockObject GetTextExtentPoint32A CreatePatternBrush DeleteMetaFile SetMetaFileBitsEx SetStretchBltMode SelectClipRgn SetPixel PatBlt PlayMetaFile StretchBlt CreateBitmap SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx SetMapMode SaveDC

advapi32

OpenProcessToken InitializeSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl RegCloseKey RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegEnumKeyExA RegEnumKeyA RegOpenKeyA FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenThreadToken

ole32

CoInitializeSecurity CoInitialize CoUninitialize

oleaut32

VariantChangeType VariantClear SysStringLen SysReAllocStringLen SysAllocStringLen SysAllocString SysFreeString GetErrorInfo

lz32

LZOpenFileA LZCopy LZClose

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetMalloc SHGetPathFromIDListA