Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231025-en - resource tags
- submitted
27/11/2023, 16:49
General
- Target 0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234.jar
- Size 67KB
- Sample231127-vb3cnsab91
- SHA256 0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234
Malware Config
Extracted
-
strrat
-
binacafe.duckdns.org:6586
-
127.0.0.1:6586
-
license_id
ON0K-D4YD-8WHU-SHV5-GE8B
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234.jar"2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234.jar"3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234.jar
3903daac9bc4a3b7.timestamp
0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234.jar
memory/988-68-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-73-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-71-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-70-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-69-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-63-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-67-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-74-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-65-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-64-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-49-0x00000273875A0000-0x00000273875A1000-memory.dmp
memory/988-51-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/988-59-0x00000273875C0000-0x00000273885C0000-memory.dmp
memory/2636-33-0x0000016C59600000-0x0000016C59610000-memory.dmp
memory/2636-35-0x0000016C59620000-0x0000016C59630000-memory.dmp
memory/2636-36-0x0000016C59350000-0x0000016C5A350000-memory.dmp
memory/2636-66-0x0000016C59350000-0x0000016C5A350000-memory.dmp
memory/2636-37-0x0000016C59630000-0x0000016C59640000-memory.dmp
memory/2636-32-0x0000016C595F0000-0x0000016C59600000-memory.dmp
memory/2636-34-0x0000016C59610000-0x0000016C59620000-memory.dmp
memory/2636-2-0x0000016C59350000-0x0000016C5A350000-memory.dmp
memory/2636-31-0x0000016C595D0000-0x0000016C595E0000-memory.dmp
memory/2636-19-0x0000016C59350000-0x0000016C5A350000-memory.dmp
memory/2636-12-0x0000016C57AC0000-0x0000016C57AC1000-memory.dmp