strrat | 760e559a3535b27d012b29e4c44767e7261e7a29f45b78189196d85b25876b5e

General

Target
Cotizaciones.jar
Size 70KB
Sample230706-gfp19aae3t
SHA256 760e559a3535b27d012b29e4c44767e7261e7a29f45b78189196d85b25876b5e
MD5 70a0aefb832e99006ed06844554ff498
SHA1 eefeee9919557f65474c7c01d11f900aba1c0f31
SHA512 8adfa7e91e312cfcaef15e7da66fee7a3a19a8054ff813432702fc5cf29c60c634e8127e41c6a5ad0d8530f58ba9fc01cf6d403bf1456b7e9d498f766aa2c3c8
SSDEEP 1536:EUUaKBlG6NcFSsprgb4OZ8kUj0DTIQLChV/dEu:EDM6NcR8b4nCTIHPKu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strrat persistence stealer trojan

Malware Config

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cotizaciones.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cotizaciones = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Cotizaciones.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cotizaciones = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Cotizaciones.jar\""	java.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3A4E4E29-20CA-4616-8E52-90359A7C4073}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2372	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2688	4816	java.exe	80
PID 4816 wrote to memory of 2688	4816	java.exe	80
PID 4816 wrote to memory of 5016	4816	java.exe	82
PID 4816 wrote to memory of 5016	4816	java.exe	82
PID 2688 wrote to memory of 2372	2688	cmd.exe	84
PID 2688 wrote to memory of 2372	2688	cmd.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Cotizaciones.jar
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Cotizaciones.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Cotizaciones.jar"
    3⤵
    - Creates scheduled task(s)
    PID:2372
- C:\Program Files\Java\jre1.8.0_66\bin\java.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Cotizaciones.jar"
  2⤵
  PID:5016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cotizaciones.jar

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Cotizaciones.jar
Size 70KB
SHA256 760e559a3535b27d012b29e4c44767e7261e7a29f45b78189196d85b25876b5e
MD5 70a0aefb832e99006ed06844554ff498
SHA1 eefeee9919557f65474c7c01d11f900aba1c0f31
SHA512 8adfa7e91e312cfcaef15e7da66fee7a3a19a8054ff813432702fc5cf29c60c634e8127e41c6a5ad0d8530f58ba9fc01cf6d403bf1456b7e9d498f766aa2c3c8
SSDEEP 1536:EUUaKBlG6NcFSsprgb4OZ8kUj0DTIQLChV/dEu:EDM6NcR8b4nCTIHPKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 e7b5056b395946d6dc8e74155d9fb2ba6d0f2133554a1448e96d47b94e3e5a9c
MD5 9a6aba2b144c3cfc7d820da5c8cfc8a9
SHA1 8c8fb35d439af1cd843c1a3581256d5c9bcc0299
SHA512 783d84f2149cdbde79eb40cad25be9491430e73a69caa1c33bf02fe094b5dd823b175cc868c1f627df0bc788f933ed1f3c55a982072894e06b540dfcb392ff7f
MD5 SHA1 SHA512

Submit Download

Cotizaciones.jar

Path C:\Users\Admin\AppData\Roaming\Cotizaciones.jar
Size 70KB
SHA256 760e559a3535b27d012b29e4c44767e7261e7a29f45b78189196d85b25876b5e
MD5 70a0aefb832e99006ed06844554ff498
SHA1 eefeee9919557f65474c7c01d11f900aba1c0f31
SHA512 8adfa7e91e312cfcaef15e7da66fee7a3a19a8054ff813432702fc5cf29c60c634e8127e41c6a5ad0d8530f58ba9fc01cf6d403bf1456b7e9d498f766aa2c3c8
SSDEEP 1536:EUUaKBlG6NcFSsprgb4OZ8kUj0DTIQLChV/dEu:EDM6NcR8b4nCTIHPKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4816-143-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/5016-164-0x0000000001360000-0x0000000001361000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads