strela | 554a0fafdff6419b90496479a6612ea829b9ec76c5dd6ad14f7a8efca964a905 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 15:49

Sharing

Report Analysis Logs

General

Target

cc66d9d61597f59462925ce69e06bb10.dll
Size

136KB
MD5

cc66d9d61597f59462925ce69e06bb10
SHA1

74d13a3e40ac0f1fd6666940d118a89aa9b98cef
SHA256

554a0fafdff6419b90496479a6612ea829b9ec76c5dd6ad14f7a8efca964a905
SHA512

d6c3aaf94b8600e4490db990d227c15260eb3f02b5bd03ae671e07645c8887acaff60a387896739b73e7d75c392a324ce803ccef6bbd403570b91a7e1ff7311e
SSDEEP

3072:3scrEJqXIvkehwvk/izYDB5WIIVkJt3ynvaJTjU:ccrXIvkbPUlQbKJ

Score

10^/10

strela stealer

Malware Config

Extracted

Family

strela

C2

94.159.113.79

Attributes

url_path
/up.php

Signatures

Detects Strela Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3004-0-0x00000000001C0000-0x00000000001E3000-memory.dmp	family_strela
behavioral1/memory/3004-1-0x00000000001C0000-0x00000000001E3000-memory.dmp	family_strela

Strela family
strela
Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cc66d9d61597f59462925ce69e06bb10.dll
1⤵
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download
memory/3004-1-0x00000000001C0000-0x00000000001E3000-memory.dmp

Filesize
140KB

Download