Edit tour

Windows Analysis Report
out.dll.dll

Overview

General Information

Sample Name:	out.dll.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	out.dll.exe
Analysis ID:	894471
MD5:	5a3ee07759e23c507915fb3d473154de
SHA1:	ef47ff06ad6a0db77183be19284dbe2c53b16a50
SHA256:	14009b05324320da1f4942c35d0cfd24b5dbc49773ce4618e6e070d74a7ffb6a
Tags:	exe
Infos:

Detection

Strela Stealer

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Strela Stealer

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

C2 URLs / IPs found in malware configuration

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

PE file contains more sections than normal

Program does not show much activity (idle)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 5764 cmdline: loaddll64.exe "C:\Users\user\Desktop\out.dll.dll" MD5: 67C05BFD8F41B3421FE285E2FE9641C7)

conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5696 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\out.dll.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 2344 cmdline: rundll32.exe "C:\Users\user\Desktop\out.dll.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 4924 cmdline: rundll32.exe C:\Users\user\Desktop\out.dll.dll,f MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6964 cmdline: rundll32.exe "C:\Users\user\Desktop\out.dll.dll",f MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

Threatname: Strela Stealer

{"C2 url": "91.215.85.209/server.php"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.395344757.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000005.00000002.401725916.0000017FE20A1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000005.00000002.401547343.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000004.00000002.389783943.0000023E74401000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000003.00000002.395509512.0000018A52C71000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
00000004.00000002.389694685.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: rundll32.exe PID: 4924	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: rundll32.exe PID: 2344	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: rundll32.exe PID: 6964	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.rundll32.exe.6d7ed404.1.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
5.2.rundll32.exe.6d7ed404.1.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
3.2.rundll32.exe.6d7ed404.1.raw.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
5.2.rundll32.exe.6d7ed404.1.raw.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
4.2.rundll32.exe.6d7ed404.1.raw.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
3.2.rundll32.exe.6d7ed404.1.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
3.2.rundll32.exe.6d7c0000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
5.2.rundll32.exe.6d7c0000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
4.2.rundll32.exe.6d7c0000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Click to see the 4 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.rundll32.exe.6d7ed404.1.raw.unpack

Malware Configuration Extractor: Strela Stealer {"C2 url": "91.215.85.209/server.php"}

Antivirus detection for URL or domain

Source: 91.215.85.209/server.php

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: 91.215.85.209/server.php

Virustotal: Detection: 17%

Perma Link

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C71770 FindFirstFileA,	3_2_0000018A52C71770
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023E74401770 FindFirstFileA,	4_2_0000023E74401770
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000017FE20A1770 FindFirstFileA,	5_2_0000017FE20A1770

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 91.215.85.209/server.php

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_6D7C13B0	3_2_6D7C13B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C712C0	3_2_0000018A52C712C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C71770	3_2_0000018A52C71770
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C7667C	3_2_0000018A52C7667C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C7E8A8	3_2_0000018A52C7E8A8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023E744012C0	4_2_0000023E744012C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023E74401770	4_2_0000023E74401770
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023E7440E8A8	4_2_0000023E7440E8A8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023E7440667C	4_2_0000023E7440667C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000017FE20A12C0	5_2_0000017FE20A12C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000017FE20A1770	5_2_0000017FE20A1770
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000017FE20AE8A8	5_2_0000017FE20AE8A8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000017FE20A667C	5_2_0000017FE20A667C

Source: out.dll.dll

Static PE information: Number of sections : 17 > 10

Source: out.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\out.dll.dll,f

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\out.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\out.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\out.dll.dll,f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\out.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\out.dll.dll",f
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\out.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\out.dll.dll,f	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\out.dll.dll",f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\out.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5748:120:WilError_01

Source: classification engine

Classification label: mal76.troj.winDLL@10/0@0/0

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: out.dll.dll

Static PE information: Image base 0x6d7c0000 > 0x60000000

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C7AF62 push esp; ret	3_2_0000018A52C7AF65
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C8652E push ecx; retf 003Fh	3_2_0000018A52C8658E
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023E7440AF62 push esp; ret	4_2_0000023E7440AF65
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000017FE20B652E push ecx; retf 003Fh	5_2_0000017FE20B658E

Source: out.dll.dll	Static PE information: section name: .xdata
Source: out.dll.dll	Static PE information: section name: /4
Source: out.dll.dll	Static PE information: section name: /19
Source: out.dll.dll	Static PE information: section name: /31
Source: out.dll.dll	Static PE information: section name: /45
Source: out.dll.dll	Static PE information: section name: /57
Source: out.dll.dll	Static PE information: section name: /70

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe TID: 5676

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C71770 FindFirstFileA,	3_2_0000018A52C71770
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023E74401770 FindFirstFileA,	4_2_0000023E74401770
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000017FE20A1770 FindFirstFileA,	5_2_0000017FE20A1770

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_6D7EADE0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	3_2_6D7EADE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000018A52C71C88 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	3_2_0000018A52C71C88
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023E74401C88 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	4_2_0000023E74401C88
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000017FE20A1C88 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	5_2_0000017FE20A1C88

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\out.dll.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_6D7EAD00 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_6D7EAD00

Stealing of Sensitive Information

Yara detected Strela Stealer

Source: Yara match	File source: 4.2.rundll32.exe.6d7ed404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d7ed404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d7ed404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d7ed404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6d7ed404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d7ed404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6d7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.395344757.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.401725916.0000017FE20A1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.401547343.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.389783943.0000023E74401000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.395509512.0000018A52C71000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.389694685.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6964, type: MEMORYSTR

Remote Access Functionality

Yara detected Strela Stealer

Source: Yara match	File source: 4.2.rundll32.exe.6d7ed404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d7ed404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d7ed404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d7ed404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6d7ed404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d7ed404.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6d7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.395344757.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.401725916.0000017FE20A1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.401547343.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.389783943.0000023E74401000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.395509512.0000018A52C71000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.389694685.000000006D7ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6964, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	1 Rundll32	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
out.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Strela Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report out.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Strela Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Windows Analysis Report
out.dll.dll