strela | 3189efaf2330177d2817cfb69a8bfa3b846c24ec534aa3e6b66c8a28f3b18d4b

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2024, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18262829011200.js
Size 345KB
Sample241103-tk2basyakf
SHA256 544887bc3f0dccb610dd7ba35b498a03ea32fca047e133a0639d5bca61cc6f45
MD5 301503edfb1ea723b231b416c2a81f0f
SHA1 dd41fda85637d2593ef4aad407371ec830fe171d
SHA512 f5df4b28a0f012b458026ef7caa2f460f51476a67e63e63641631dc5672b4920422618afb36af17373ffdfcc678370dc965678f3d3f1dda5326589c2a471f9d5
SSDEEP 6144:FSxcuKYMvWe+ch9Bi7PoOCSElpHMnOInDOWPZsngSKTj+c42pf:+cRYMv5+ctgEBmODYsw+h2pf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strela defense_evasion execution stealer

Malware Config

Extracted

Family

strela

193.109.85.231

Attributes

url_path
/server.php
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537

Signatures

Detects Strela Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/1884-390-0x00007FFF57600000-0x00007FFF57647000-memory.dmp	family_strela

Strela family
strela
Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
1884	rundll32.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2008	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4092	4456	wscript.exe	84
PID 4456 wrote to memory of 4092	4456	wscript.exe	84
PID 4092 wrote to memory of 2356	4092	cmd.exe	89
PID 4092 wrote to memory of 2356	4092	cmd.exe	89
PID 4092 wrote to memory of 2008	4092	cmd.exe	90
PID 4092 wrote to memory of 2008	4092	cmd.exe	90
PID 4092 wrote to memory of 1896	4092	cmd.exe	91
PID 4092 wrote to memory of 1896	4092	cmd.exe	91
PID 1896 wrote to memory of 1884	1896	cmd.exe	92
PID 1896 wrote to memory of 1884	1896	cmd.exe	92

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\18262829011200.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\18262829011200.js" "C:\Users\Admin\AppData\Local\Temp\\trousersperpetual.bat" && "C:\Users\Admin\AppData\Local\Temp\\trousersperpetual.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\findstr.exe
    findstr /V marrywise ""C:\Users\Admin\AppData\Local\Temp\\trousersperpetual.bat""
    3⤵
    PID:2356
- - C:\Windows\system32\certutil.exe
    certutil -f -decode magnificentdevelopment returnready.dll
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2008
- - C:\Windows\system32\cmd.exe
    cmd /c rundll32 returnready.dll,m
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\rundll32.exe
      rundll32 returnready.dll,m
      4⤵
      Loads dropped DLL
      PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

magnificentdevelopment

Path C:\Users\Admin\AppData\Local\Temp\magnificentdevelopment
Size 338KB
SHA256 54d3f28c9044ca9b16d3584d7bfac00c65f8aa6369801b340e1a7348d4681bef
MD5 04d8d28e9039e6861017650bb59f24b3
SHA1 53741049bc23ab05658dc32ad54326a87dd0edee
SHA512 05c9830335b82a5dd020e097e8fb3241e52d60875d951b13dfe82ad590c922ed6884ae5f9a1d2a6270c0d3456bc88ed8d373c5fdedca8a604f65ce986f00cf32
SSDEEP 6144:iSxcuKYMvWe+ch9Bi7PoOCSElpHMnOInDOWPZsngSKTj+c42pm:ZcRYMv5+ctgEBmODYsw+h2pm
MD5 SHA1 SHA512 SSDEEP

Submit Download

returnready.dll

Path C:\Users\Admin\AppData\Local\Temp\returnready.dll
Size 252KB
SHA256 e6991b12e86629b38e178fef129dfda1d454391ffbb236703f8c026d6d55b9a1
MD5 9499f14143b34ea7703c73b5f9b37013
SHA1 ceff6b19826c9a4e9b9e8cbcc512d5241a27825e
SHA512 f14dec41f677fb3e2af064b4b7a6b3b15bec8429a831a78247513853d4ce7511ed37e89e52ebadbed03ab9115dcea3cc316b90e99c939d07402b5a554d722668
SSDEEP 6144:jzsV8coTHnuHTUhgYl8b56IqokNJpgGpkeUB:LTHuHT01B316B
MD5 SHA1 SHA512 SSDEEP

Submit Download

trousersperpetual.bat

Path C:\Users\Admin\AppData\Local\Temp\trousersperpetual.bat
Size 345KB
SHA256 544887bc3f0dccb610dd7ba35b498a03ea32fca047e133a0639d5bca61cc6f45
MD5 301503edfb1ea723b231b416c2a81f0f
SHA1 dd41fda85637d2593ef4aad407371ec830fe171d
SHA512 f5df4b28a0f012b458026ef7caa2f460f51476a67e63e63641631dc5672b4920422618afb36af17373ffdfcc678370dc965678f3d3f1dda5326589c2a471f9d5
SSDEEP 6144:FSxcuKYMvWe+ch9Bi7PoOCSElpHMnOInDOWPZsngSKTj+c42pf:+cRYMv5+ctgEBmODYsw+h2pf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1884-390-0x00007FFF57600000-0x00007FFF57647000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads