strrat | bdb39f75a5b8e2cc95b68a96e5bcf4660449dfb1523a8d00dbf9444206acae02

Analysis

max time kernel
150s
max time network
180s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/05/2023, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation-List-Copy.jar
Size

70KB
MD5

1770e031366e2d91415fa1a1d902814a
SHA1

ef37063f282a2e6d70c9800b20dc45889c3fa90c
SHA256

bdb39f75a5b8e2cc95b68a96e5bcf4660449dfb1523a8d00dbf9444206acae02
SHA512

c9206823d5fc8bda1d9e8385a90cc0171366f7968c56d8ab6a11c2e5b53f1c0243f3b1148ed0001efcba5e313f6efa43b7af0c74e6b882c613d66ca7fad61a02
SSDEEP

1536:DSpNvzfcN5YRlN1qhlV0EwVW948MrlDzOyJgtMNNp7FFbKL6aw62ZLsY+azgR4Wi:kvzUYh+Zo5lDSSC6f7d64+34zZEskc

Score

10^/10

strrat persistence stealer trojan

Malware Config

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation-List-Copy.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation-List-Copy = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation-List-Copy.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation-List-Copy = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation-List-Copy.jar\""	java.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1764	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1312	WMIC.exe
Token: SeSecurityPrivilege	1312	WMIC.exe
Token: SeTakeOwnershipPrivilege	1312	WMIC.exe
Token: SeLoadDriverPrivilege	1312	WMIC.exe
Token: SeSystemProfilePrivilege	1312	WMIC.exe
Token: SeSystemtimePrivilege	1312	WMIC.exe
Token: SeProfSingleProcessPrivilege	1312	WMIC.exe
Token: SeIncBasePriorityPrivilege	1312	WMIC.exe
Token: SeCreatePagefilePrivilege	1312	WMIC.exe
Token: SeBackupPrivilege	1312	WMIC.exe
Token: SeRestorePrivilege	1312	WMIC.exe
Token: SeShutdownPrivilege	1312	WMIC.exe
Token: SeDebugPrivilege	1312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1312	WMIC.exe
Token: SeRemoteShutdownPrivilege	1312	WMIC.exe
Token: SeUndockPrivilege	1312	WMIC.exe
Token: SeManageVolumePrivilege	1312	WMIC.exe
Token: 33	1312	WMIC.exe
Token: 34	1312	WMIC.exe
Token: 35	1312	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1312	WMIC.exe
Token: SeSecurityPrivilege	1312	WMIC.exe
Token: SeTakeOwnershipPrivilege	1312	WMIC.exe
Token: SeLoadDriverPrivilege	1312	WMIC.exe
Token: SeSystemProfilePrivilege	1312	WMIC.exe
Token: SeSystemtimePrivilege	1312	WMIC.exe
Token: SeProfSingleProcessPrivilege	1312	WMIC.exe
Token: SeIncBasePriorityPrivilege	1312	WMIC.exe
Token: SeCreatePagefilePrivilege	1312	WMIC.exe
Token: SeBackupPrivilege	1312	WMIC.exe
Token: SeRestorePrivilege	1312	WMIC.exe
Token: SeShutdownPrivilege	1312	WMIC.exe
Token: SeDebugPrivilege	1312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1312	WMIC.exe
Token: SeRemoteShutdownPrivilege	1312	WMIC.exe
Token: SeUndockPrivilege	1312	WMIC.exe
Token: SeManageVolumePrivilege	1312	WMIC.exe
Token: 33	1312	WMIC.exe
Token: 34	1312	WMIC.exe
Token: 35	1312	WMIC.exe
Token: SeIncreaseQuotaPrivilege	316	WMIC.exe
Token: SeSecurityPrivilege	316	WMIC.exe
Token: SeTakeOwnershipPrivilege	316	WMIC.exe
Token: SeLoadDriverPrivilege	316	WMIC.exe
Token: SeSystemProfilePrivilege	316	WMIC.exe
Token: SeSystemtimePrivilege	316	WMIC.exe
Token: SeProfSingleProcessPrivilege	316	WMIC.exe
Token: SeIncBasePriorityPrivilege	316	WMIC.exe
Token: SeCreatePagefilePrivilege	316	WMIC.exe
Token: SeBackupPrivilege	316	WMIC.exe
Token: SeRestorePrivilege	316	WMIC.exe
Token: SeShutdownPrivilege	316	WMIC.exe
Token: SeDebugPrivilege	316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	316	WMIC.exe
Token: SeRemoteShutdownPrivilege	316	WMIC.exe
Token: SeUndockPrivilege	316	WMIC.exe
Token: SeManageVolumePrivilege	316	WMIC.exe
Token: 33	316	WMIC.exe
Token: 34	316	WMIC.exe
Token: 35	316	WMIC.exe
Token: SeIncreaseQuotaPrivilege	316	WMIC.exe
Token: SeSecurityPrivilege	316	WMIC.exe
Token: SeTakeOwnershipPrivilege	316	WMIC.exe
Token: SeLoadDriverPrivilege	316	WMIC.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1244	1504	java.exe	28
PID 1504 wrote to memory of 1244	1504	java.exe	28
PID 1504 wrote to memory of 1244	1504	java.exe	28
PID 1504 wrote to memory of 1852	1504	java.exe	29
PID 1504 wrote to memory of 1852	1504	java.exe	29
PID 1504 wrote to memory of 1852	1504	java.exe	29
PID 1244 wrote to memory of 1764	1244	cmd.exe	30
PID 1244 wrote to memory of 1764	1244	cmd.exe	30
PID 1244 wrote to memory of 1764	1244	cmd.exe	30
PID 1852 wrote to memory of 1200	1852	java.exe	31
PID 1852 wrote to memory of 1200	1852	java.exe	31
PID 1852 wrote to memory of 1200	1852	java.exe	31
PID 1200 wrote to memory of 1312	1200	cmd.exe	32
PID 1200 wrote to memory of 1312	1200	cmd.exe	32
PID 1200 wrote to memory of 1312	1200	cmd.exe	32
PID 1852 wrote to memory of 1780	1852	java.exe	34
PID 1852 wrote to memory of 1780	1852	java.exe	34
PID 1852 wrote to memory of 1780	1852	java.exe	34
PID 1780 wrote to memory of 316	1780	cmd.exe	35
PID 1780 wrote to memory of 316	1780	cmd.exe	35
PID 1780 wrote to memory of 316	1780	cmd.exe	35
PID 1852 wrote to memory of 1796	1852	java.exe	36
PID 1852 wrote to memory of 1796	1852	java.exe	36
PID 1852 wrote to memory of 1796	1852	java.exe	36
PID 1796 wrote to memory of 1692	1796	cmd.exe	37
PID 1796 wrote to memory of 1692	1796	cmd.exe	37
PID 1796 wrote to memory of 1692	1796	cmd.exe	37
PID 1852 wrote to memory of 1360	1852	java.exe	38
PID 1852 wrote to memory of 1360	1852	java.exe	38
PID 1852 wrote to memory of 1360	1852	java.exe	38
PID 1360 wrote to memory of 1988	1360	cmd.exe	39
PID 1360 wrote to memory of 1988	1360	cmd.exe	39
PID 1360 wrote to memory of 1988	1360	cmd.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Quotation-List-Copy.jar
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Quotation-List-Copy.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Quotation-List-Copy.jar"
    3⤵
    - Creates scheduled task(s)
    PID:1764
- C:\Program Files\Java\jre7\bin\java.exe
  "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Quotation-List-Copy.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1312
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:316
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
      4⤵
      PID:1692
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list
      4⤵
      PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Quotation-List-Copy.jar

Filesize
70KB

MD5
1770e031366e2d91415fa1a1d902814a

SHA1
ef37063f282a2e6d70c9800b20dc45889c3fa90c

SHA256
bdb39f75a5b8e2cc95b68a96e5bcf4660449dfb1523a8d00dbf9444206acae02

SHA512
c9206823d5fc8bda1d9e8385a90cc0171366f7968c56d8ab6a11c2e5b53f1c0243f3b1148ed0001efcba5e313f6efa43b7af0c74e6b882c613d66ca7fad61a02

Download Submit
C:\Users\Admin\AppData\Roaming\Quotation-List-Copy.jar

Filesize
70KB

MD5
1770e031366e2d91415fa1a1d902814a

SHA1
ef37063f282a2e6d70c9800b20dc45889c3fa90c

SHA256
bdb39f75a5b8e2cc95b68a96e5bcf4660449dfb1523a8d00dbf9444206acae02

SHA512
c9206823d5fc8bda1d9e8385a90cc0171366f7968c56d8ab6a11c2e5b53f1c0243f3b1148ed0001efcba5e313f6efa43b7af0c74e6b882c613d66ca7fad61a02

Download Submit
memory/1504-63-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1852-81-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1852-84-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads