Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 07:07
Behavioral task
behavioral1
Sample
Isteme-Formu.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Isteme-Formu.jar
Resource
win10v2004-20240226-en
General
-
Target
Isteme-Formu.jar
-
Size
64KB
-
MD5
1437058c6d28f9a7a3ccdeaceda607bd
-
SHA1
5d7b2f57c74739f8e077dafd25964ef3f990b0ca
-
SHA256
9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b
-
SHA512
835b0a988b39f0615d5a7d06a980e26cab4eae567aaa7b5636e076a89e12b132b3def781b891fedfb434844f2348cbe89ae0ead8c014b3f1e02b21628a4d7ef9
-
SSDEEP
1536:fs4vu4cVMHH4/o0oJ4pxtOPLYr/09xIYd3W4Un:fXuMHY/JhtOPLYey4Un
Malware Config
Extracted
strrat
elastsolek21.duckdns.org:4781
zekeriyasolek45.duckdns.org:4781
-
license_id
WFC9-W4KB-388F-9KY1-S6JV
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isteme-Formu.jar java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isteme-Formu = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Isteme-Formu.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isteme-Formu = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Isteme-Formu.jar\"" java.exe -
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 5036 wrote to memory of 4996 5036 java.exe icacls.exe PID 5036 wrote to memory of 4996 5036 java.exe icacls.exe PID 5036 wrote to memory of 4472 5036 java.exe cmd.exe PID 5036 wrote to memory of 4472 5036 java.exe cmd.exe PID 5036 wrote to memory of 2772 5036 java.exe java.exe PID 5036 wrote to memory of 2772 5036 java.exe java.exe PID 4472 wrote to memory of 4832 4472 cmd.exe schtasks.exe PID 4472 wrote to memory of 4832 4472 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Isteme-Formu.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"2⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Isteme-Formu.jarFilesize
64KB
MD59ad218d305544323b46f77f485e32d26
SHA12d2ce27ef293cef704327d547b1a1d7054ec6dad
SHA256bdf46dfe4d433f31e57f6894e5ee468debec0b2f81294040f060d055b485360f
SHA512fa40ee20c240b335dcf71784477086f0d5b84ee5a7a16be2ed256f69b6dcf59e178758a555ef5fbe3ca7c66092279cb13105d25e0db16bc38cf1d4fc16271078
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD507cef5e2d122e3877bf7556bdb958bf4
SHA17bde0babb1e87b39075efcc4b3605bdbd0b6ef3e
SHA256a95d4f12b649ab31923e1fcff7611c95276b721a658d5fbeffd8d2e71410e62d
SHA51204b56e7635d6b5a90e33de663e26577673bab50377278334da321458d60347d9857455d95490fce900f161a9004bf823e5e833334231b17514aeaa954f033785
-
C:\Users\Admin\AppData\Roaming\Isteme-Formu.jarFilesize
64KB
MD51437058c6d28f9a7a3ccdeaceda607bd
SHA15d7b2f57c74739f8e077dafd25964ef3f990b0ca
SHA2569c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b
SHA512835b0a988b39f0615d5a7d06a980e26cab4eae567aaa7b5636e076a89e12b132b3def781b891fedfb434844f2348cbe89ae0ead8c014b3f1e02b21628a4d7ef9
-
memory/2772-60-0x000001BB2B8F0000-0x000001BB2C8F0000-memory.dmpFilesize
16.0MB
-
memory/2772-59-0x000001BB2BBA0000-0x000001BB2BBB0000-memory.dmpFilesize
64KB
-
memory/2772-58-0x000001BB2BB90000-0x000001BB2BBA0000-memory.dmpFilesize
64KB
-
memory/2772-57-0x000001BB2BB80000-0x000001BB2BB90000-memory.dmpFilesize
64KB
-
memory/2772-56-0x000001BB2BB70000-0x000001BB2BB80000-memory.dmpFilesize
64KB
-
memory/2772-52-0x000001BB2B8F0000-0x000001BB2C8F0000-memory.dmpFilesize
16.0MB
-
memory/2772-47-0x000001BB2A060000-0x000001BB2A061000-memory.dmpFilesize
4KB
-
memory/2772-40-0x000001BB2B8F0000-0x000001BB2C8F0000-memory.dmpFilesize
16.0MB
-
memory/5036-28-0x0000024E69D40000-0x0000024E6AD40000-memory.dmpFilesize
16.0MB
-
memory/5036-34-0x0000024E6A020000-0x0000024E6A030000-memory.dmpFilesize
64KB
-
memory/5036-33-0x0000024E6A000000-0x0000024E6A010000-memory.dmpFilesize
64KB
-
memory/5036-32-0x0000024E6A010000-0x0000024E6A020000-memory.dmpFilesize
64KB
-
memory/5036-31-0x0000024E69FF0000-0x0000024E6A000000-memory.dmpFilesize
64KB
-
memory/5036-30-0x0000024E69FE0000-0x0000024E69FF0000-memory.dmpFilesize
64KB
-
memory/5036-29-0x0000024E69FC0000-0x0000024E69FD0000-memory.dmpFilesize
64KB
-
memory/5036-4-0x0000024E69D40000-0x0000024E6AD40000-memory.dmpFilesize
16.0MB
-
memory/5036-18-0x0000024E69D40000-0x0000024E6AD40000-memory.dmpFilesize
16.0MB
-
memory/5036-12-0x0000024E68460000-0x0000024E68461000-memory.dmpFilesize
4KB