Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-03-2024 07:07

General

  • Target

    Isteme-Formu.jar

  • Size

    64KB

  • MD5

    1437058c6d28f9a7a3ccdeaceda607bd

  • SHA1

    5d7b2f57c74739f8e077dafd25964ef3f990b0ca

  • SHA256

    9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b

  • SHA512

    835b0a988b39f0615d5a7d06a980e26cab4eae567aaa7b5636e076a89e12b132b3def781b891fedfb434844f2348cbe89ae0ead8c014b3f1e02b21628a4d7ef9

  • SSDEEP

    1536:fs4vu4cVMHH4/o0oJ4pxtOPLYr/09xIYd3W4Un:fXuMHY/JhtOPLYey4Un

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\Isteme-Formu.jar
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Windows\system32\cmd.exe
      cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"
        3⤵
        • Creates scheduled task(s)
        PID:2600
    • C:\Program Files\Java\jre7\bin\java.exe
      "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"
      2⤵
        PID:2692

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Isteme-Formu.jar
      Filesize

      64KB

      MD5

      1437058c6d28f9a7a3ccdeaceda607bd

      SHA1

      5d7b2f57c74739f8e077dafd25964ef3f990b0ca

      SHA256

      9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b

      SHA512

      835b0a988b39f0615d5a7d06a980e26cab4eae567aaa7b5636e076a89e12b132b3def781b891fedfb434844f2348cbe89ae0ead8c014b3f1e02b21628a4d7ef9

    • memory/2692-22-0x00000000026D0000-0x00000000056D0000-memory.dmp
      Filesize

      48.0MB

    • memory/2692-29-0x0000000000140000-0x0000000000141000-memory.dmp
      Filesize

      4KB

    • memory/2692-30-0x00000000026D0000-0x00000000056D0000-memory.dmp
      Filesize

      48.0MB

    • memory/2932-6-0x00000000025B0000-0x00000000055B0000-memory.dmp
      Filesize

      48.0MB

    • memory/2932-10-0x0000000000140000-0x0000000000141000-memory.dmp
      Filesize

      4KB