Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 20:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad00b64c7f97358dbab93d3d606957413c4ff7bba33954e0ad4d4a34fc7e5dafN.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
120 seconds
General
-
Target
ad00b64c7f97358dbab93d3d606957413c4ff7bba33954e0ad4d4a34fc7e5dafN.dll
-
Size
381KB
-
MD5
c136e7decbe57dbd8dc1b57d5f3d63e0
-
SHA1
1aad22639ec629282c3b3926b675eb86190d55df
-
SHA256
ad00b64c7f97358dbab93d3d606957413c4ff7bba33954e0ad4d4a34fc7e5daf
-
SHA512
c9e7ced7fc63dfa35bad27337f6376764de70c356f1378e0e7d7e4e1ab1de6ce4833fd46ed0c6ca68926b890124ae3ea004d3eae71ba896ffb3a706b87c85a66
-
SSDEEP
6144:k3kBMFHRbi8wunhuAKDz0zbaLH5mnqdrcBnu++9ql7VlBhq0QYgUfB:ksMFxO8LxKDzbeqrcqqVVlBtQYf
Malware Config
Signatures
-
Detects Strela Stealer payload 3 IoCs
resource yara_rule behavioral2/memory/1800-1-0x00000000007D0000-0x0000000000830000-memory.dmp family_strela behavioral2/memory/1800-0-0x00000000007D0000-0x0000000000830000-memory.dmp family_strela behavioral2/memory/1800-3-0x00000000007D0000-0x0000000000830000-memory.dmp family_strela -
Strela family
Processes
Network
-
Remote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request64.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.130.81.91.in-addr.arpaIN PTRResponse
No results found
-
73 B 147 B 1 1
DNS Request
217.106.137.52.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
64.159.190.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
133.130.81.91.in-addr.arpa