Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
26/09/2023, 10:36
General
- Target PAYMENT-9262023.js
- Size 293KB
- Sample230926-mnhvsshg62
- SHA256 24d1e734345b0206fd0c673cb5a98f876cf4392c79c5f5dc5237b61ca37afb7c
Malware Config
Extracted
-
strrat
-
96.47.233.13:8454
-
license_id
7C80-HMCX-T9VH-K5QU-BQT2
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PAYMENT-9262023.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Local\Temp\PO-21-2023.jar"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PO-21-2023.jar
memory/4840-6-0x0000000002E70000-0x0000000003E70000-memory.dmp
memory/4840-14-0x0000000001090000-0x0000000001091000-memory.dmp
memory/4840-18-0x0000000001090000-0x0000000001091000-memory.dmp
memory/4840-27-0x0000000002E70000-0x0000000003E70000-memory.dmp
memory/4840-31-0x0000000002E70000-0x0000000003E70000-memory.dmp
memory/4840-46-0x0000000001090000-0x0000000001091000-memory.dmp
memory/4840-47-0x0000000002E70000-0x0000000003E70000-memory.dmp
memory/4840-58-0x0000000002E70000-0x0000000003E70000-memory.dmp
memory/4840-68-0x0000000002E70000-0x0000000003E70000-memory.dmp
memory/4840-80-0x0000000001090000-0x0000000001091000-memory.dmp
memory/4840-90-0x0000000001090000-0x0000000001091000-memory.dmp
memory/4840-99-0x0000000001090000-0x0000000001091000-memory.dmp
memory/4840-120-0x0000000002E70000-0x0000000003E70000-memory.dmp
memory/4840-133-0x0000000002E70000-0x0000000003E70000-memory.dmp