Analysis
- max time kernel
312s - max time network
318s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 13:33
General
- Target 14052163e50c197697c64b143.exe
- Size 17.6MB
- Sample240409-qthc1abe5y
- SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
Malware Config
Extracted
-
strrat
-
rar.ydns.eu:9999
-
svchost.ydns.eu:10000
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
false
-
secondary_startup
false
-
startup
true
Extracted
-
ps1
-
ps1.dropper
https://files.catbox.moe/fvl5hy.jpg
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Blocklisted process makes network request 13 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 13 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 6 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 2 IoCs
- Modifies registry class 1 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 27 IoCs
- Suspicious use of SendNotifyMessage 27 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 57 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txtC:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 05⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 05⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
-
C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck283142⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck283142⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck283142⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck283142⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
rrrrrrrr.ps1
32.exe
64.exe
Antimalware Service Executable.JS
CL_Debug_Log.txt
CR_Debug_Log.txt
EmbraTor Mac Smash Bullet.exe
Java Install.jar
MsMpEng.js
SystemCheck.xml
Windows Driver Foundation.vbs
__PSScriptPolicyTest_jil1jlz3.c4x.ps1
aut6E84.tmp
x.exe
Antimalware Service Executable.JS
SysBackup.tmp
Tor.tmp
cached-microdesc-consensus.tmp
cached-microdescs.new
TorConfig
libcrypto-1_1-x64.dll
libevent-2-1-7.dll
libssl-1_1-x64.dll
libssp-0.dll
libwinpthread-1.dll
tor.exe
zlib1.dll
memory/464-267-0x0000000000DA0000-0x0000000001201000-memory.dmp
memory/464-243-0x0000000000DA0000-0x0000000001201000-memory.dmp
memory/464-228-0x0000000057B90000-0x0000000057C73000-memory.dmp
memory/464-229-0x0000000057B30000-0x0000000057B84000-memory.dmp
memory/464-233-0x0000000057840000-0x0000000057B2D000-memory.dmp
memory/464-234-0x0000000057760000-0x0000000057833000-memory.dmp
memory/464-235-0x0000000057730000-0x0000000057753000-memory.dmp
memory/464-236-0x0000000057690000-0x0000000057728000-memory.dmp
memory/464-298-0x0000000000DA0000-0x0000000001201000-memory.dmp
memory/464-224-0x0000000000DA0000-0x0000000001201000-memory.dmp
memory/464-291-0x0000000000DA0000-0x0000000001201000-memory.dmp
memory/464-283-0x0000000000DA0000-0x0000000001201000-memory.dmp
memory/464-274-0x0000000000DA0000-0x0000000001201000-memory.dmp
memory/464-256-0x0000000000DA0000-0x0000000001201000-memory.dmp
memory/1860-255-0x0000021F72260000-0x0000021F72383000-memory.dmp
memory/1860-174-0x0000021F72260000-0x0000021F72383000-memory.dmp
memory/1860-177-0x0000021F72260000-0x0000021F72383000-memory.dmp
memory/1860-179-0x0000021F72260000-0x0000021F72383000-memory.dmp
memory/2252-130-0x0000000006060000-0x000000000607A000-memory.dmp
memory/2252-129-0x0000000007270000-0x00000000078EA000-memory.dmp
memory/2252-90-0x0000000004890000-0x00000000048AE000-memory.dmp
memory/2252-56-0x0000000004DD0000-0x0000000004E36000-memory.dmp
memory/2252-69-0x00000000056B0000-0x0000000005A04000-memory.dmp
memory/2252-93-0x0000000005BC0000-0x0000000005C0C000-memory.dmp
memory/2252-63-0x0000000004EB0000-0x0000000004F16000-memory.dmp
memory/2252-49-0x0000000004940000-0x0000000004950000-memory.dmp
memory/2252-44-0x0000000002210000-0x0000000002246000-memory.dmp
memory/2252-53-0x0000000004D30000-0x0000000004D52000-memory.dmp
memory/2252-47-0x0000000073660000-0x0000000073E10000-memory.dmp
memory/2252-141-0x0000000073660000-0x0000000073E10000-memory.dmp
memory/2252-48-0x0000000004F80000-0x00000000055A8000-memory.dmp
memory/2252-50-0x0000000004940000-0x0000000004950000-memory.dmp
memory/2464-161-0x000000000B060000-0x000000000B061000-memory.dmp
memory/2464-167-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/2464-162-0x000000000B070000-0x000000000B071000-memory.dmp
memory/2464-159-0x000000000B040000-0x000000000B041000-memory.dmp
memory/2464-158-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/2464-128-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/4440-125-0x000001990B0C0000-0x000001990C0C0000-memory.dmp
memory/4440-120-0x000001990B0C0000-0x000001990C0C0000-memory.dmp
memory/4440-115-0x000001990B370000-0x000001990B380000-memory.dmp
memory/4440-111-0x000001990B0C0000-0x000001990C0C0000-memory.dmp
memory/4440-116-0x000001990B3B0000-0x000001990B3C0000-memory.dmp
memory/4440-95-0x000001990B0C0000-0x000001990C0C0000-memory.dmp
memory/4440-117-0x000001990B410000-0x000001990B420000-memory.dmp
memory/4440-88-0x0000019909800000-0x0000019909801000-memory.dmp
memory/4440-82-0x000001990B0C0000-0x000001990C0C0000-memory.dmp
memory/4440-73-0x000001990B0C0000-0x000001990C0C0000-memory.dmp
memory/4440-119-0x000001990B3A0000-0x000001990B3B0000-memory.dmp
memory/4440-114-0x000001990B340000-0x000001990B350000-memory.dmp
memory/4440-118-0x000001990B420000-0x000001990B430000-memory.dmp
memory/4440-121-0x000001990B3C0000-0x000001990B3D0000-memory.dmp
memory/4440-46-0x0000019909800000-0x0000019909801000-memory.dmp
memory/4440-122-0x000001990B3E0000-0x000001990B3F0000-memory.dmp
memory/4440-124-0x000001990B3F0000-0x000001990B400000-memory.dmp
memory/4440-126-0x000001990B400000-0x000001990B410000-memory.dmp
memory/4440-172-0x000001990B0C0000-0x000001990C0C0000-memory.dmp
memory/4440-127-0x000001990B0C0000-0x000001990C0C0000-memory.dmp
memory/4440-34-0x000001990B0C0000-0x000001990C0C0000-memory.dmp