strrat | e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar
Size 67KB
Sample230830-tv14aafh71
SHA256 e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c
MD5 108df93eef430d530c7554de038371f5
SHA1 0590dfff555b05aedf684cb37265443f8c210ddb
SHA512 aa3b3dd7af7e179870bf538bac96a5931a3017c63bce3cf8b01b7d8a1f2b212a451ea656127619415a6232a58ba2988e50102c7a3fc7bac5b13b42d80ea9792d
SSDEEP 1536:eugjLKW2GuTkX11ndkJ2gxgIcwK84b4kRtcVNU3iI:ep2GfnkJ2kK8W4wCVGyI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strrat persistence stealer trojan

Malware Config

Extracted

Family

strrat

192.169.6.4:1244

Attributes

license_id
N1CE-8GAY-P2S2-ES1R-058Y
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
true
secondary_startup
true
startup
true

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar\""	java.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	java.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2060	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 1788	2788	java.exe	84
PID 2788 wrote to memory of 1788	2788	java.exe	84
PID 2788 wrote to memory of 220	2788	java.exe	83
PID 2788 wrote to memory of 220	2788	java.exe	83
PID 1788 wrote to memory of 2060	1788	cmd.exe	87
PID 1788 wrote to memory of 2060	1788	cmd.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files\Java\jre1.8.0_66\bin\java.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar"
  2⤵
  - Drops file in Program Files directory
  PID:220
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar"
    3⤵
    - Creates scheduled task(s)
    PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar
Size 67KB
SHA256 e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c
MD5 108df93eef430d530c7554de038371f5
SHA1 0590dfff555b05aedf684cb37265443f8c210ddb
SHA512 aa3b3dd7af7e179870bf538bac96a5931a3017c63bce3cf8b01b7d8a1f2b212a451ea656127619415a6232a58ba2988e50102c7a3fc7bac5b13b42d80ea9792d
SSDEEP 1536:eugjLKW2GuTkX11ndkJ2gxgIcwK84b4kRtcVNU3iI:ep2GfnkJ2kK8W4wCVGyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 35a930b5d2f35b9e297c3d2113027bd33cfc7ec4cc249266c6b7c89eb4a99e27
MD5 b4c80f23f42f2cdebe580a0ab271d5cd
SHA1 c412d3bb0143d620697e0f4a4a0fbe253f4a5e23
SHA512 409c6567245e54ad116faf4c99eb55468d0fcedf3493ee64053d74374fbc035f8df8d429f275e9b8ef59b7ec480dd77daa1311f3153659ce56ac9dcd65bfa99a
MD5 SHA1 SHA512

Submit Download

e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar

Path C:\Users\Admin\AppData\Roaming\e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c_JC.jar
Size 67KB
SHA256 e21c5199346f5c21edacda6db7687e8b3ca8896a6165b4c34028f16e0898669c
MD5 108df93eef430d530c7554de038371f5
SHA1 0590dfff555b05aedf684cb37265443f8c210ddb
SHA512 aa3b3dd7af7e179870bf538bac96a5931a3017c63bce3cf8b01b7d8a1f2b212a451ea656127619415a6232a58ba2988e50102c7a3fc7bac5b13b42d80ea9792d
SSDEEP 1536:eugjLKW2GuTkX11ndkJ2gxgIcwK84b4kRtcVNU3iI:ep2GfnkJ2kK8W4wCVGyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-30-0x0000000002D50000-0x0000000003D50000-memory.dmp

Download

memory/220-37-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Download

memory/2788-4-0x00000000032F0000-0x00000000042F0000-memory.dmp

Download

memory/2788-11-0x0000000001660000-0x0000000001661000-memory.dmp

Download

memory/2788-21-0x00000000032F0000-0x00000000042F0000-memory.dmp

Download

memory/2788-22-0x0000000003570000-0x0000000003580000-memory.dmp

Download

memory/2788-23-0x0000000003580000-0x0000000003590000-memory.dmp

Download

memory/2788-40-0x00000000032F0000-0x00000000042F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads