Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-03-2024 06:24
Behavioral task
behavioral1
Sample
New Order NO 4705008982 DTD.jar
Resource
win7-20240221-en
General
-
Target
New Order NO 4705008982 DTD.jar
-
Size
209KB
-
MD5
70c7e80f047ed2162aff41a46b770dd8
-
SHA1
6d02a11dba0bb998c5581bb4bec3ab2dcd02c646
-
SHA256
841594fe3e8400fc4162f73b0b1393c4903d0225f25c73277ba2ec442b8095ec
-
SHA512
6b875f1e6afeb46b413fef3fe34625b6e2ba83b2b9043a53eeeac53aa0694362a59b281e7b14bb3ab0630b199d208d56e1c9016d6f9e8e081d8ed5ff69c3c165
-
SSDEEP
6144:S8A8lJAHv//RZfeEzydRZ4V9DCHJuPPCVmyKx:S8plSHzWEi29DCH6mKx
Malware Config
Extracted
strrat
tzitziklishop3.ddns.net:7800
103.114.104.158:7800
-
license_id
DB1U-CVGT-7HUG-X0A0-GNWH
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
java.exedescription pid process target process PID 4360 wrote to memory of 3704 4360 java.exe icacls.exe PID 4360 wrote to memory of 3704 4360 java.exe icacls.exe PID 4360 wrote to memory of 2348 4360 java.exe java.exe PID 4360 wrote to memory of 2348 4360 java.exe java.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\New Order NO 4705008982 DTD.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\New Order NO 4705008982 DTD.jar"2⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD581c451fd727d1a1dbcc111e00009a0af
SHA10a0860fa7dcea6cecafb81a1d8232502f939f112
SHA256add31fb0a412fdf72ce8b0946e97c59dd16d98312e6091f885ebbbe673f28443
SHA512c9aab5d0021833a4babf52128d8263ea4ca65ed3b4bfb657776d1ca1f46c0e1a6277655a12df74c39286d4607af64738d2a604e274c10c565cbe636fc04dfc26
-
C:\Users\Admin\New Order NO 4705008982 DTD.jarFilesize
209KB
MD570c7e80f047ed2162aff41a46b770dd8
SHA16d02a11dba0bb998c5581bb4bec3ab2dcd02c646
SHA256841594fe3e8400fc4162f73b0b1393c4903d0225f25c73277ba2ec442b8095ec
SHA5126b875f1e6afeb46b413fef3fe34625b6e2ba83b2b9043a53eeeac53aa0694362a59b281e7b14bb3ab0630b199d208d56e1c9016d6f9e8e081d8ed5ff69c3c165
-
C:\Users\Admin\lib\jna-5.5.0.jarFilesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
C:\Users\Admin\lib\jna-platform-5.5.0.jarFilesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jarFilesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
C:\Users\Admin\lib\system-hook-3.5.jarFilesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
memory/2348-123-0x0000023200000000-0x0000023201000000-memory.dmpFilesize
16.0MB
-
memory/2348-122-0x0000023200000000-0x0000023201000000-memory.dmpFilesize
16.0MB
-
memory/2348-116-0x000002327BC00000-0x000002327BC01000-memory.dmpFilesize
4KB
-
memory/2348-105-0x0000023200000000-0x0000023201000000-memory.dmpFilesize
16.0MB
-
memory/4360-50-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-94-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-65-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-66-0x0000017A377D0000-0x0000017A387D0000-memory.dmpFilesize
16.0MB
-
memory/4360-68-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-71-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-76-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-79-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-93-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-63-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-99-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-59-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-55-0x0000017A377D0000-0x0000017A387D0000-memory.dmpFilesize
16.0MB
-
memory/4360-53-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-4-0x0000017A377D0000-0x0000017A387D0000-memory.dmpFilesize
16.0MB
-
memory/4360-46-0x0000017A377D0000-0x0000017A387D0000-memory.dmpFilesize
16.0MB
-
memory/4360-34-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB
-
memory/4360-31-0x0000017A377D0000-0x0000017A387D0000-memory.dmpFilesize
16.0MB
-
memory/4360-18-0x0000017A377D0000-0x0000017A387D0000-memory.dmpFilesize
16.0MB
-
memory/4360-12-0x0000017A35F50000-0x0000017A35F51000-memory.dmpFilesize
4KB