strela | 14636b7fc900e2be3fee5abb409e3b7a3cdf5a99107bf6d7dcbcce4b26ee0d34

Analysis

max time kernel
141s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.exe
Size 10.0MB
Sample240918-sycdnaycnf
SHA256 14636b7fc900e2be3fee5abb409e3b7a3cdf5a99107bf6d7dcbcce4b26ee0d34
MD5 e96dd956bc2159ff1d073876ef5d4e58
SHA1 a0da0d7c8394d646eb5a0f64be14397235f22704
SHA512 c2334b9c666174d38213c1cd84a8f2f9fbfbeea8e18f7fdf7e0b6bab70377e7d1a8f01fe45688bcbfcc2bb85933aa97a829c1feb94ede874b1426dd320080806
SSDEEP 196608:Mem6/gb2N3s9m35DylYLan8CmD5zpX9o38vR/dnG0sb9iMly9ssSGz8EQgCPhtv:MelYyVYm3RLaQ5zpNq8NdnExiMw+P4QD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela discovery stealer

Malware Config

Signatures

Detects Strela Stealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002362f-10.dat	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Executes dropped EXE 1 IoCs

pid	Process
1480	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp

Loads dropped DLL 4 IoCs

pid	Process
1480	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp
1480	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp
1480	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp
1480	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp

Kills process with taskkill 1 IoCs

evasion

pid	Process
212	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 1480	4436	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.exe	89
PID 4436 wrote to memory of 1480	4436	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.exe	89
PID 4436 wrote to memory of 1480	4436	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.exe	89
PID 1480 wrote to memory of 212	1480	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp	90
PID 1480 wrote to memory of 212	1480	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp	90
PID 1480 wrote to memory of 212	1480	e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp	90

C:\Users\Admin\AppData\Local\Temp\e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\is-16BO2.tmp\e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-16BO2.tmp\e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp" /SL5="$6028C,9993427,175104,C:\Users\Admin\AppData\Local\Temp\e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill.exe" /f /im "net_updater32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
1⤵
PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-16BO2.tmp\e96dd956bc2159ff1d073876ef5d4e58_JaffaCakes118.tmp
Size 1.2MB
SHA256 4dc2d414277e497490d2009f370051298bccaa649d0a335b064269a0bb9bbbf3
MD5 eb42e5720e09cd014694a22c86929f5e
SHA1 b619dccd5e1deb090d8eae6c6bac5e5dae91fdfb
SHA512 4f5ea3e32f7da75799b8067351a860f6c840dba8108c92d34d4be7d6b811140e6b2dd161ba4bd90df77dff41b74e1e85b536b3776cadb656018a1914acc3ee2f
SSDEEP 24576:5MTKlxyr9d8f0iQuDTK11dJfO2kJGqZdELeCInQOyTNFeZh9Mpxqc+:+2ScZ2eC9DFeZXEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
MD5 SHA1 SHA512

Submit Download

back.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\back.png
Size 2KB
SHA256 806f42fddd09b24993ec053e6fdcae023e4833b371590843a498aacac20b8c7c
MD5 ef9ed169ba900bc5250d0210d25619e3
SHA1 d333ee23b4441e7da0109886159f7c9e78819c5c
SHA512 042e7fef639b74e421ab456e41301dedd1a91f29795b5594eea89ee95ff6c44b3f72936e639f8671bba3874fb6f536c7ef01bc878c5e3a1bdc1e73ae2f716267
MD5 SHA1 SHA512

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
MD5 SHA1 SHA512 SSDEEP

Submit Download

btn_browser.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\btn_browser.png
Size 2KB
SHA256 0f6e9827ef681b88722d2013ae44fe5f8eeeaf22b6fe64904ecd0852de8197c8
MD5 8dd4f9f2c22073544694eca39c4f305d
SHA1 f7944cd8aa4f4b5233867dbdcea034a8d4be69e2
SHA512 1c8708c77e8e61659ad7a903a4b5431e72532645486ca62e9b84d42f2e1fce2ebf07d17b64241656e08f32d766843dea6bc40fe7e8ff6e010201de8860a0d189
MD5 SHA1 SHA512

Submit Download

btn_close.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\btn_close.png
Size 204B
SHA256 8a6026306c1774d027022b3ee600c34b296ab8135f46c872d74c734baa239eac
MD5 b780d58e26ddf76733743501d00123d4
SHA1 594b7196378628bcc7107e8186e2f2f6da07ac0b
SHA512 8691a1c2a00311f31224fee23803a91bc2a7597aa2ac928cfc43291b7c6cfd89bce7f7fd60d8448603b5c441ff2706f9686e1fa71c56041d0c5377eb1e14ba5c
MD5 SHA1 SHA512

Submit Download

btn_min.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\btn_min.png
Size 103B
SHA256 686967328122f54acd92f85f6c162d42a8f607148f511ec4f7ab41010fc7db66
MD5 2e9c0f6a83184050751c5cb0dfae2397
SHA1 f1c3e7a900db6572ac0940b833b1ec30141bc17d
SHA512 03256bfcf0df9e390e1cfa1b4571aece489270d6c72f231db1c0a1d22b9c181a89fb2865810af217956b052eb47f34d5636edef4606074f607203358370ffc90
MD5 SHA1 SHA512

Submit Download

btn_n.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\btn_n.png
Size 1KB
SHA256 d9f0859f6a5648b0a9060200cc9a7534161e1b22844f631766e4e3540090790a
MD5 66deff37283bca24ea963ae3a3963b38
SHA1 6c2410db0d9d77ed8019c01d68cb9fcdfa93b330
SHA512 706a5f2b297694f48f623ba3ab9b0cbadd4a48be9d3b619ec76cf0aadf1638134d65a8de492b869573c136665778bfe86133cb9973d47f29f95683c4bb83faa6
MD5 SHA1 SHA512

Submit Download

btn_setup.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\btn_setup.png
Size 4KB
SHA256 d95a68be5109a23db0d0dff20ba3453ca69d39f48f2ae996255b84557a96881b
MD5 212afbaedaa752a5e8957a609a0ae9f1
SHA1 73e210e0fdd3ac797e6b30bb57a17f2ddd195002
SHA512 b83e22c50f011f2bb42ea6936bd2b776d9371c933119a7aa19181cb2a3f7e050478c8e679410aea39ecc750b408ecf55fd927bad1234fa041a89ebd737ac5061
SSDEEP 96:eGYbUjCbnRbeTznukSeafg+UYun40j5f/6zm1vn48Q8kQHa:e7bOPukSt4+UYy4gYQ48CQHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

checkboxdeep.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\checkboxdeep.png
Size 351B
SHA256 ecfe768ec009c8cb24edb1dd3cfe8a8e8a583fcfc90ec90442ce1c8d59241cdc
MD5 3f5325a8962d480ccb89be73e7e054b5
SHA1 319e2f9e1c6c681f79265f6b24606574cbbeebbc
SHA512 5994ba26c4fdc4ae3a94af2e0e48e3e173c8094fa8b069bfa47b1403ba8283e2ee312f49c308eed2f0d9d244373577244c6d8e4495d4f91f8b6597fff90b4db1
MD5 SHA1 SHA512

Submit Download

license.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\license.png
Size 1KB
SHA256 9a004daa7630d4916c962e681f1a1f95db3ff476fe82272dc937f7ac200683a2
MD5 8277d98e048ba1adf360d63622f5b0bf
SHA1 0bdc270cd963b2b34e919250455062f782052a47
SHA512 5b8a354efe4073473a92118027b06d1fe599a422f395fbfa17ce0bf5c3a0cb94c7bfadb1c324e66829ad478e1561200259d32d05514fbaa22f6bbc3a90a8579a
MD5 SHA1 SHA512

Submit Download

util.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\util.dll
Size 1010KB
SHA256 a2ef6b8fbf44bc77631d5635b8abedf90db5903b94618753168f5a904ebc5f60
MD5 192c98cb51f39be053ad5c7e029e75f8
SHA1 2fbb285edc39d51a0e56a7ef996c9f67c4b1a015
SHA512 4b810f8861d037e3581fadb17a7a22f29648eb651d9bbd2827167fdce94975a5eef25d899009286ce6636a59732b6728510b6f9e151ea2d026f764dd1fd5bf2e
SSDEEP 24576:hSMYHbdz2zJoYeWLakQ4YblJ6fhvBg0WVi6p62:4bdkOW9Q4YbDqdi0Qi6p62
MD5 SHA1 SHA512 SSDEEP

Submit Download

xy.png

Path C:\Users\Admin\AppData\Local\Temp\is-IRN8D.tmp\xy.png
Size 11KB
SHA256 31137ad0ef19381e1778eb89b6cb9f70a9ee5244ad943ad494e1e57b18b48ab7
MD5 e92f3fbf3876c4044722fd975281b3ff
SHA1 d92877cad872663616a48f25af291e8bffb246aa
SHA512 46fdb373fe54ecf762adcba6a08a0e2e67080d97931fe1407d4f60b74921d9ef7d38ec7104271805635a015ba5230a09e16de60010aecc5c404ae376efddfac7
SSDEEP 192:3BmtbJeXpcprCkxqxfdt7+IhdT0GskeZxA8jghr4cp3ZmpuhxUBej7SsvW:3AKcJCGqN1Tikcf9cpcUheBaW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1480-56-0x0000000003420000-0x000000000342E000-memory.dmp

Download

memory/1480-7-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/1480-107-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/1480-108-0x0000000003420000-0x000000000342E000-memory.dmp

Download

memory/1480-114-0x0000000003420000-0x000000000342E000-memory.dmp

Download

memory/4436-2-0x0000000000401000-0x0000000000412000-memory.dmp

Download

memory/4436-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4436-106-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads