strrat | 3bc3579f84354fe3b51fd60254362bb523a76beb34adb1fa1cedd2b34dfbb61a

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-7-6-23.jar
Size 70KB
Sample230707-hs7x9sff78
SHA256 3bc3579f84354fe3b51fd60254362bb523a76beb34adb1fa1cedd2b34dfbb61a
MD5 0e3fdb5b619f6a39b6a6ea16cd930c97
SHA1 43a992927b4019290c7ce11fa0d8f4ac0913c063
SHA512 811dd76df42c9f8f290ffe0ae4c16963c62ff285fe68500c23292f36516e2beb90a152b567593e32e2f30b7c678fac89aab1b274e6c8376c96f7ee8c463b1ff7
SSDEEP 1536:2pFnNUl/6kMKiPIh9mnzxZxCJbyWxQX05oAhL7BN46ju5XFzvke:EFNw/6kMKuI9o47xQX0WAhL7I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strrat persistence stealer trojan

Malware Config

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-7-6-23.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO-7-6-23 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\PO-7-6-23.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO-7-6-23 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\PO-7-6-23.jar\""	java.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	ip-api.com

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3008	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	212	WMIC.exe
Token: SeSecurityPrivilege	212	WMIC.exe
Token: SeTakeOwnershipPrivilege	212	WMIC.exe
Token: SeLoadDriverPrivilege	212	WMIC.exe
Token: SeSystemProfilePrivilege	212	WMIC.exe
Token: SeSystemtimePrivilege	212	WMIC.exe
Token: SeProfSingleProcessPrivilege	212	WMIC.exe
Token: SeIncBasePriorityPrivilege	212	WMIC.exe
Token: SeCreatePagefilePrivilege	212	WMIC.exe
Token: SeBackupPrivilege	212	WMIC.exe
Token: SeRestorePrivilege	212	WMIC.exe
Token: SeShutdownPrivilege	212	WMIC.exe
Token: SeDebugPrivilege	212	WMIC.exe
Token: SeSystemEnvironmentPrivilege	212	WMIC.exe
Token: SeRemoteShutdownPrivilege	212	WMIC.exe
Token: SeUndockPrivilege	212	WMIC.exe
Token: SeManageVolumePrivilege	212	WMIC.exe
Token: 33	212	WMIC.exe
Token: 34	212	WMIC.exe
Token: 35	212	WMIC.exe
Token: 36	212	WMIC.exe
Token: SeIncreaseQuotaPrivilege	212	WMIC.exe
Token: SeSecurityPrivilege	212	WMIC.exe
Token: SeTakeOwnershipPrivilege	212	WMIC.exe
Token: SeLoadDriverPrivilege	212	WMIC.exe
Token: SeSystemProfilePrivilege	212	WMIC.exe
Token: SeSystemtimePrivilege	212	WMIC.exe
Token: SeProfSingleProcessPrivilege	212	WMIC.exe
Token: SeIncBasePriorityPrivilege	212	WMIC.exe
Token: SeCreatePagefilePrivilege	212	WMIC.exe
Token: SeBackupPrivilege	212	WMIC.exe
Token: SeRestorePrivilege	212	WMIC.exe
Token: SeShutdownPrivilege	212	WMIC.exe
Token: SeDebugPrivilege	212	WMIC.exe
Token: SeSystemEnvironmentPrivilege	212	WMIC.exe
Token: SeRemoteShutdownPrivilege	212	WMIC.exe
Token: SeUndockPrivilege	212	WMIC.exe
Token: SeManageVolumePrivilege	212	WMIC.exe
Token: 33	212	WMIC.exe
Token: 34	212	WMIC.exe
Token: 35	212	WMIC.exe
Token: 36	212	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1860	WMIC.exe
Token: SeSecurityPrivilege	1860	WMIC.exe
Token: SeTakeOwnershipPrivilege	1860	WMIC.exe
Token: SeLoadDriverPrivilege	1860	WMIC.exe
Token: SeSystemProfilePrivilege	1860	WMIC.exe
Token: SeSystemtimePrivilege	1860	WMIC.exe
Token: SeProfSingleProcessPrivilege	1860	WMIC.exe
Token: SeIncBasePriorityPrivilege	1860	WMIC.exe
Token: SeCreatePagefilePrivilege	1860	WMIC.exe
Token: SeBackupPrivilege	1860	WMIC.exe
Token: SeRestorePrivilege	1860	WMIC.exe
Token: SeShutdownPrivilege	1860	WMIC.exe
Token: SeDebugPrivilege	1860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1860	WMIC.exe
Token: SeRemoteShutdownPrivilege	1860	WMIC.exe
Token: SeUndockPrivilege	1860	WMIC.exe
Token: SeManageVolumePrivilege	1860	WMIC.exe
Token: 33	1860	WMIC.exe
Token: 34	1860	WMIC.exe
Token: 35	1860	WMIC.exe
Token: 36	1860	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1860	WMIC.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 640	2012	java.exe	88
PID 2012 wrote to memory of 640	2012	java.exe	88
PID 2012 wrote to memory of 4832	2012	java.exe	89
PID 2012 wrote to memory of 4832	2012	java.exe	89
PID 640 wrote to memory of 3008	640	cmd.exe	92
PID 640 wrote to memory of 3008	640	cmd.exe	92
PID 4832 wrote to memory of 3812	4832	java.exe	98
PID 4832 wrote to memory of 3812	4832	java.exe	98
PID 3812 wrote to memory of 212	3812	cmd.exe	100
PID 3812 wrote to memory of 212	3812	cmd.exe	100
PID 4832 wrote to memory of 4824	4832	java.exe	101
PID 4832 wrote to memory of 4824	4832	java.exe	101
PID 4824 wrote to memory of 1860	4824	cmd.exe	103
PID 4824 wrote to memory of 1860	4824	cmd.exe	103
PID 4832 wrote to memory of 1560	4832	java.exe	104
PID 4832 wrote to memory of 1560	4832	java.exe	104
PID 1560 wrote to memory of 556	1560	cmd.exe	106
PID 1560 wrote to memory of 556	1560	cmd.exe	106
PID 4832 wrote to memory of 2364	4832	java.exe	107
PID 4832 wrote to memory of 2364	4832	java.exe	107
PID 2364 wrote to memory of 644	2364	cmd.exe	109
PID 2364 wrote to memory of 644	2364	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\PO-7-6-23.jar
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO-7-6-23.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO-7-6-23.jar"
    3⤵
    - Creates scheduled task(s)
    PID:3008
- C:\Program Files\Java\jre1.8.0_66\bin\java.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\PO-7-6-23.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:212
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
      4⤵
      PID:556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
      4⤵
      PID:644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PO-7-6-23.jar

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\PO-7-6-23.jar
Size 70KB
SHA256 3bc3579f84354fe3b51fd60254362bb523a76beb34adb1fa1cedd2b34dfbb61a
MD5 0e3fdb5b619f6a39b6a6ea16cd930c97
SHA1 43a992927b4019290c7ce11fa0d8f4ac0913c063
SHA512 811dd76df42c9f8f290ffe0ae4c16963c62ff285fe68500c23292f36516e2beb90a152b567593e32e2f30b7c678fac89aab1b274e6c8376c96f7ee8c463b1ff7
SSDEEP 1536:2pFnNUl/6kMKiPIh9mnzxZxCJbyWxQX05oAhL7BN46ju5XFzvke:EFNw/6kMKuI9o47xQX0WAhL7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 71d3248f105e8d31e9058c58a85108037b601340f95c1ea08b1a779f0aae5e8e
MD5 5f8ef41b2d9e088ecd176202b160b820
SHA1 87c32a8f3bc217fc72a633d57429988b2859083a
SHA512 8e54a090fcb88ef6191f68820f714fd7bcd418b78d72b31c598ec236fec911656f624f2e9014838485e3725ffa267a073e2b6b9a880e941051d5dc7749f7a12a
MD5 SHA1 SHA512

Submit Download

PO-7-6-23.jar

Path C:\Users\Admin\AppData\Roaming\PO-7-6-23.jar
Size 70KB
SHA256 3bc3579f84354fe3b51fd60254362bb523a76beb34adb1fa1cedd2b34dfbb61a
MD5 0e3fdb5b619f6a39b6a6ea16cd930c97
SHA1 43a992927b4019290c7ce11fa0d8f4ac0913c063
SHA512 811dd76df42c9f8f290ffe0ae4c16963c62ff285fe68500c23292f36516e2beb90a152b567593e32e2f30b7c678fac89aab1b274e6c8376c96f7ee8c463b1ff7
SSDEEP 1536:2pFnNUl/6kMKiPIh9mnzxZxCJbyWxQX05oAhL7BN46ju5XFzvke:EFNw/6kMKuI9o47xQX0WAhL7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2012-143-0x0000000001490000-0x0000000001491000-memory.dmp

Download

memory/4832-165-0x00000000014B0000-0x00000000014B1000-memory.dmp

Download

memory/4832-171-0x00000000014B0000-0x00000000014B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads