Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
06/03/2024, 02:00
General
- Target 03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10.jar
- Size 209KB
- Sample240306-ce5cbshb98
- SHA256 03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10
Malware Config
Extracted
-
strrat
-
jugoken567.ddns.net:7800
-
103.151.123.225:7800
-
license_id
DB1U-CVGT-7HUG-X0A0-GNWH
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10.jar"3⤵
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10.jar"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/2040-98-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-104-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-27-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-36-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-41-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-42-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-45-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-63-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-75-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-77-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-79-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-80-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-82-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-81-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-83-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-85-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-89-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-92-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-95-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-97-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-12-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-99-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-101-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-17-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-105-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-106-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-108-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-110-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-114-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-115-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-116-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-117-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-119-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-121-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-129-0x000002A797950000-0x000002A797951000-memory.dmp
memory/2040-131-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-132-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-136-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-4-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-137-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/2040-138-0x000002A799210000-0x000002A79A210000-memory.dmp
memory/3604-150-0x0000026D44690000-0x0000026D45690000-memory.dmp
memory/3604-163-0x0000026D44670000-0x0000026D44671000-memory.dmp
memory/3604-169-0x0000026D44690000-0x0000026D45690000-memory.dmp
memory/3604-174-0x0000026D44690000-0x0000026D45690000-memory.dmp
memory/3604-178-0x0000026D44690000-0x0000026D45690000-memory.dmp