Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20/01/2022, 07:38

General

  • Target

    Remittance_Advice.jar

  • Size

    177KB

  • MD5

    e5df17e52c9ad8157ef9ad8c42072f6e

  • SHA1

    7b998e5455ffeef99cbf3e02e8ff057220ce9749

  • SHA256

    6a695e198d37c905288cf2ad103315559c7f870a2f92b03fbdcfabe0a8a34ba6

  • SHA512

    c8983cf43ef8dcfd651dd2ae788b2f1b97bfff5fe0406c1bcbe4a5d30b6adae005208a9463e3f9163bc6b7439a252547c2ccb110da77e8f33c450087e855542e

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\Remittance_Advice.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Program Files\Java\jre7\bin\java.exe
      "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\Remittance_Advice.jar"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Windows\system32\cmd.exe
        cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Remittance_Advice.jar"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\system32\schtasks.exe
          schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Remittance_Advice.jar"
          4⤵
          • Creates scheduled task(s)
          PID:1300
      • C:\Program Files\Java\jre7\bin\java.exe
        "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Remittance_Advice.jar"
        3⤵
          PID:1644

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1152-130-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1152-122-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1152-123-0x0000000002160000-0x0000000005160000-memory.dmp

            Filesize

            48.0MB

          • memory/1520-94-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-104-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-110-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-111-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-106-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-107-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-105-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-109-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-55-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

            Filesize

            8KB

          • memory/1520-92-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-70-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-61-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-59-0x0000000000120000-0x0000000000121000-memory.dmp

            Filesize

            4KB

          • memory/1520-57-0x00000000021D0000-0x00000000051D0000-memory.dmp

            Filesize

            48.0MB