Analysis
-
max time kernel
76s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
30-08-2020 06:36
Static task
static1
Behavioral task
behavioral1
Sample
Rechnung.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Rechnung.jar
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
Rechnung.jar
-
Size
424KB
-
MD5
03bdde0d47b8c25a13f53f6fbba8b08b
-
SHA1
0bc4b8ff28f996ddebaa5eede774d23498fbb6e8
-
SHA256
be9d8b26678dd00c0cfc0cdbd59f5510247fce9379a7213ceaeeef1c0207f27c
-
SHA512
07a0518aab94e9e812f6e4fa0e96045c43cbddf2c412e3c27b693c9e39ec82ff336d3547825e90be5981ee1fe1f384b721ce8166a4c8630169865a6f465e41aa
Score
10/10
Malware Config
Signatures
-
Qarallax RAT support DLL 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ae28-68.dat qarallax_dll -
Loads dropped DLL 1 IoCs
pid Process 3684 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\koNVrQY = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\gNKCW\\qgTkj.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\koNVrQY = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\gNKCW\\qgTkj.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File created C:\Users\Admin\gNKCW\Desktop.ini java.exe File opened for modification C:\Users\Admin\gNKCW\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\gNKCW\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\gNKCW\Desktop.ini java.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\HhZlS java.exe File created C:\Windows\System32\HhZlS java.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = f52cba1ca87ed601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe -
Suspicious use of AdjustPrivilegeToken 128 IoCs
description pid Process Token: SeShutdownPrivilege 364 svchost.exe Token: SeCreatePagefilePrivilege 364 svchost.exe Token: SeIncreaseQuotaPrivilege 1324 WMIC.exe Token: SeSecurityPrivilege 1324 WMIC.exe Token: SeTakeOwnershipPrivilege 1324 WMIC.exe Token: SeLoadDriverPrivilege 1324 WMIC.exe Token: SeSystemProfilePrivilege 1324 WMIC.exe Token: SeSystemtimePrivilege 1324 WMIC.exe Token: SeProfSingleProcessPrivilege 1324 WMIC.exe Token: SeIncBasePriorityPrivilege 1324 WMIC.exe Token: SeCreatePagefilePrivilege 1324 WMIC.exe Token: SeBackupPrivilege 1324 WMIC.exe Token: SeRestorePrivilege 1324 WMIC.exe Token: SeShutdownPrivilege 1324 WMIC.exe Token: SeDebugPrivilege 1324 WMIC.exe Token: SeSystemEnvironmentPrivilege 1324 WMIC.exe Token: SeRemoteShutdownPrivilege 1324 WMIC.exe Token: SeUndockPrivilege 1324 WMIC.exe Token: SeManageVolumePrivilege 1324 WMIC.exe Token: 33 1324 WMIC.exe Token: 34 1324 WMIC.exe Token: 35 1324 WMIC.exe Token: 36 1324 WMIC.exe Token: SeIncreaseQuotaPrivilege 1324 WMIC.exe Token: SeSecurityPrivilege 1324 WMIC.exe Token: SeTakeOwnershipPrivilege 1324 WMIC.exe Token: SeLoadDriverPrivilege 1324 WMIC.exe Token: SeSystemProfilePrivilege 1324 WMIC.exe Token: SeSystemtimePrivilege 1324 WMIC.exe Token: SeProfSingleProcessPrivilege 1324 WMIC.exe Token: SeIncBasePriorityPrivilege 1324 WMIC.exe Token: SeCreatePagefilePrivilege 1324 WMIC.exe Token: SeBackupPrivilege 1324 WMIC.exe Token: SeRestorePrivilege 1324 WMIC.exe Token: SeShutdownPrivilege 1324 WMIC.exe Token: SeDebugPrivilege 1324 WMIC.exe Token: SeSystemEnvironmentPrivilege 1324 WMIC.exe Token: SeRemoteShutdownPrivilege 1324 WMIC.exe Token: SeUndockPrivilege 1324 WMIC.exe Token: SeManageVolumePrivilege 1324 WMIC.exe Token: 33 1324 WMIC.exe Token: 34 1324 WMIC.exe Token: 35 1324 WMIC.exe Token: 36 1324 WMIC.exe Token: SeIncreaseQuotaPrivilege 1856 WMIC.exe Token: SeSecurityPrivilege 1856 WMIC.exe Token: SeTakeOwnershipPrivilege 1856 WMIC.exe Token: SeLoadDriverPrivilege 1856 WMIC.exe Token: SeSystemProfilePrivilege 1856 WMIC.exe Token: SeSystemtimePrivilege 1856 WMIC.exe Token: SeProfSingleProcessPrivilege 1856 WMIC.exe Token: SeIncBasePriorityPrivilege 1856 WMIC.exe Token: SeCreatePagefilePrivilege 1856 WMIC.exe Token: SeBackupPrivilege 1856 WMIC.exe Token: SeRestorePrivilege 1856 WMIC.exe Token: SeShutdownPrivilege 1856 WMIC.exe Token: SeDebugPrivilege 1856 WMIC.exe Token: SeSystemEnvironmentPrivilege 1856 WMIC.exe Token: SeRemoteShutdownPrivilege 1856 WMIC.exe Token: SeUndockPrivilege 1856 WMIC.exe Token: SeManageVolumePrivilege 1856 WMIC.exe Token: 33 1856 WMIC.exe Token: 34 1856 WMIC.exe Token: 35 1856 WMIC.exe Token: 36 1856 WMIC.exe Token: SeIncreaseQuotaPrivilege 1856 WMIC.exe Token: SeSecurityPrivilege 1856 WMIC.exe Token: SeTakeOwnershipPrivilege 1856 WMIC.exe Token: SeLoadDriverPrivilege 1856 WMIC.exe Token: SeSystemProfilePrivilege 1856 WMIC.exe Token: SeSystemtimePrivilege 1856 WMIC.exe Token: SeProfSingleProcessPrivilege 1856 WMIC.exe Token: SeIncBasePriorityPrivilege 1856 WMIC.exe Token: SeCreatePagefilePrivilege 1856 WMIC.exe Token: SeBackupPrivilege 1856 WMIC.exe Token: SeRestorePrivilege 1856 WMIC.exe Token: SeShutdownPrivilege 1856 WMIC.exe Token: SeDebugPrivilege 1856 WMIC.exe Token: SeSystemEnvironmentPrivilege 1856 WMIC.exe Token: SeRemoteShutdownPrivilege 1856 WMIC.exe Token: SeUndockPrivilege 1856 WMIC.exe Token: SeManageVolumePrivilege 1856 WMIC.exe Token: 33 1856 WMIC.exe Token: 34 1856 WMIC.exe Token: 35 1856 WMIC.exe Token: 36 1856 WMIC.exe Token: SeIncreaseQuotaPrivilege 2756 WMIC.exe Token: SeSecurityPrivilege 2756 WMIC.exe Token: SeTakeOwnershipPrivilege 2756 WMIC.exe Token: SeLoadDriverPrivilege 2756 WMIC.exe Token: SeSystemProfilePrivilege 2756 WMIC.exe Token: SeSystemtimePrivilege 2756 WMIC.exe Token: SeProfSingleProcessPrivilege 2756 WMIC.exe Token: SeIncBasePriorityPrivilege 2756 WMIC.exe Token: SeCreatePagefilePrivilege 2756 WMIC.exe Token: SeBackupPrivilege 2756 WMIC.exe Token: SeRestorePrivilege 2756 WMIC.exe Token: SeShutdownPrivilege 2756 WMIC.exe Token: SeDebugPrivilege 2756 WMIC.exe Token: SeSystemEnvironmentPrivilege 2756 WMIC.exe Token: SeRemoteShutdownPrivilege 2756 WMIC.exe Token: SeUndockPrivilege 2756 WMIC.exe Token: SeManageVolumePrivilege 2756 WMIC.exe Token: 33 2756 WMIC.exe Token: 34 2756 WMIC.exe Token: 35 2756 WMIC.exe Token: 36 2756 WMIC.exe Token: SeIncreaseQuotaPrivilege 2756 WMIC.exe Token: SeSecurityPrivilege 2756 WMIC.exe Token: SeTakeOwnershipPrivilege 2756 WMIC.exe Token: SeLoadDriverPrivilege 2756 WMIC.exe Token: SeSystemProfilePrivilege 2756 WMIC.exe Token: SeSystemtimePrivilege 2756 WMIC.exe Token: SeProfSingleProcessPrivilege 2756 WMIC.exe Token: SeIncBasePriorityPrivilege 2756 WMIC.exe Token: SeCreatePagefilePrivilege 2756 WMIC.exe Token: SeBackupPrivilege 2756 WMIC.exe Token: SeRestorePrivilege 2756 WMIC.exe Token: SeShutdownPrivilege 2756 WMIC.exe Token: SeDebugPrivilege 2756 WMIC.exe Token: SeSystemEnvironmentPrivilege 2756 WMIC.exe Token: SeRemoteShutdownPrivilege 2756 WMIC.exe Token: SeUndockPrivilege 2756 WMIC.exe Token: SeManageVolumePrivilege 2756 WMIC.exe Token: 33 2756 WMIC.exe Token: 34 2756 WMIC.exe Token: 35 2756 WMIC.exe Token: 36 2756 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3684 java.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3684 wrote to memory of 3200 3684 java.exe 76 PID 3684 wrote to memory of 3200 3684 java.exe 76 PID 3684 wrote to memory of 3700 3684 java.exe 78 PID 3684 wrote to memory of 3700 3684 java.exe 78 PID 3700 wrote to memory of 1324 3700 cmd.exe 80 PID 3700 wrote to memory of 1324 3700 cmd.exe 80 PID 3684 wrote to memory of 2072 3684 java.exe 81 PID 3684 wrote to memory of 2072 3684 java.exe 81 PID 2072 wrote to memory of 1856 2072 cmd.exe 83 PID 2072 wrote to memory of 1856 2072 cmd.exe 83 PID 3684 wrote to memory of 3068 3684 java.exe 84 PID 3684 wrote to memory of 3068 3684 java.exe 84 PID 3684 wrote to memory of 3644 3684 java.exe 86 PID 3684 wrote to memory of 3644 3684 java.exe 86 PID 3684 wrote to memory of 736 3684 java.exe 88 PID 3684 wrote to memory of 736 3684 java.exe 88 PID 3684 wrote to memory of 696 3684 java.exe 89 PID 3684 wrote to memory of 696 3684 java.exe 89 PID 3684 wrote to memory of 3892 3684 java.exe 91 PID 3684 wrote to memory of 3892 3684 java.exe 91 PID 3684 wrote to memory of 3144 3684 java.exe 93 PID 3684 wrote to memory of 3144 3684 java.exe 93 PID 3684 wrote to memory of 3920 3684 java.exe 95 PID 3684 wrote to memory of 3920 3684 java.exe 95 PID 3684 wrote to memory of 4004 3684 java.exe 97 PID 3684 wrote to memory of 4004 3684 java.exe 97 PID 3684 wrote to memory of 3780 3684 java.exe 100 PID 3684 wrote to memory of 3780 3684 java.exe 100 PID 3780 wrote to memory of 2756 3780 cmd.exe 102 PID 3780 wrote to memory of 2756 3780 cmd.exe 102 -
Views/modifies file attributes 1 TTPs 8 IoCs
pid Process 4004 attrib.exe 3068 attrib.exe 3644 attrib.exe 736 attrib.exe 696 attrib.exe 3892 attrib.exe 3144 attrib.exe 3920 attrib.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Rechnung.jar1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵PID:3200
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
PID:3068
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
PID:3644
-
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\gNKCW\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:736
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\gNKCW\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:696
-
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\gNKCW2⤵
- Views/modifies file attributes
PID:3892
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\gNKCW2⤵
- Views/modifies file attributes
PID:3144
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\gNKCW2⤵
- Views/modifies file attributes
PID:3920
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s +r C:\Users\Admin\gNKCW\qgTkj.class2⤵
- Views/modifies file attributes
PID:4004
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵PID:2756
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:364