Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/03/2024, 05:14
General
- Target 67e00d139b6348ec53d26f3cdcc3e958fe76a35ea933199a615e210667a5ade7.jar
- Size 209KB
- Sample240303-fxcxksdd91
- SHA256 67e00d139b6348ec53d26f3cdcc3e958fe76a35ea933199a615e210667a5ade7
Malware Config
Extracted
-
strrat
-
tzitziklishop3.ddns.net:7800
-
103.114.104.158:7800
-
license_id
DB1U-CVGT-7HUG-X0A0-GNWH
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\67e00d139b6348ec53d26f3cdcc3e958fe76a35ea933199a615e210667a5ade7.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\67e00d139b6348ec53d26f3cdcc3e958fe76a35ea933199a615e210667a5ade7.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\67e00d139b6348ec53d26f3cdcc3e958fe76a35ea933199a615e210667a5ade7.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\67e00d139b6348ec53d26f3cdcc3e958fe76a35ea933199a615e210667a5ade7.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\67e00d139b6348ec53d26f3cdcc3e958fe76a35ea933199a615e210667a5ade7.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
67e00d139b6348ec53d26f3cdcc3e958fe76a35ea933199a615e210667a5ade7.jar
jna6904615692744219815.dll
83aa4cc77f591dfc2374580bbd95f6ba_fd53e311-4742-43c9-a8e2-ced45f79c52d
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/224-196-0x000001F50E120000-0x000001F50F120000-memory.dmp
memory/224-184-0x000001F50E100000-0x000001F50E101000-memory.dmp
memory/224-190-0x000001F50E120000-0x000001F50F120000-memory.dmp
memory/224-182-0x000001F50E120000-0x000001F50F120000-memory.dmp
memory/224-192-0x000001F50E100000-0x000001F50E101000-memory.dmp
memory/224-208-0x000001F50E120000-0x000001F50F120000-memory.dmp
memory/224-209-0x000001F50E120000-0x000001F50F120000-memory.dmp
memory/1000-110-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-63-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-80-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-83-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-85-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-88-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-95-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-98-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-104-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-107-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-73-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-111-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-117-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-118-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-119-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-120-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-121-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-124-0x00000257DBD80000-0x00000257DBD90000-memory.dmp
memory/1000-126-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-74-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-130-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-8-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-12-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-18-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-27-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-28-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-41-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-40-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-56-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-55-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-54-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/1000-47-0x00000257DB8B0000-0x00000257DC8B0000-memory.dmp
memory/1000-48-0x00000257DA060000-0x00000257DA061000-memory.dmp
memory/3920-166-0x0000021AE4A40000-0x0000021AE4A50000-memory.dmp
memory/3920-165-0x0000021AE4A30000-0x0000021AE4A40000-memory.dmp
memory/3920-163-0x0000021AE4790000-0x0000021AE5790000-memory.dmp
memory/3920-164-0x0000021AE4A10000-0x0000021AE4A20000-memory.dmp
memory/3920-149-0x0000021AE4790000-0x0000021AE5790000-memory.dmp
memory/3920-143-0x0000021AE4770000-0x0000021AE4771000-memory.dmp
memory/3920-141-0x0000021AE4790000-0x0000021AE5790000-memory.dmp