Analysis
- max time kernel
434s - max time network
1161s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
09/04/2024, 13:34
General
- Target Java Install.jar
- Size 92KB
- Sample240409-qvlrtabe9s
- SHA256 16ed7004aa68efab0eda75b3f9bff11508365a4224ef859c91f93029bc441284
Malware Config
Extracted
-
strrat
-
rar.ydns.eu:9999
-
svchost.ydns.eu:10000
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
false
-
secondary_startup
false
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Program Files directory 12 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\Java Install.jar"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Java Install.jar"3⤵
- Drops file in Program Files directory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
jna2137698630390894055.dll
83aa4cc77f591dfc2374580bbd95f6ba_64d87529-6233-45c4-bbce-8eb6b51089f8
Java Install.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/2380-194-0x00000172CDB90000-0x00000172CEB90000-memory.dmp
memory/2380-170-0x00000172CDB90000-0x00000172CEB90000-memory.dmp
memory/2380-195-0x00000172CDE10000-0x00000172CDE20000-memory.dmp
memory/2380-200-0x00000172CDE70000-0x00000172CDE80000-memory.dmp
memory/2380-181-0x00000172CDB90000-0x00000172CEB90000-memory.dmp
memory/2380-197-0x00000172CDE60000-0x00000172CDE70000-memory.dmp
memory/2380-202-0x00000172CDE80000-0x00000172CDE90000-memory.dmp
memory/2380-199-0x00000172CDE90000-0x00000172CDEA0000-memory.dmp
memory/2380-165-0x00000172CDB90000-0x00000172CEB90000-memory.dmp
memory/2380-159-0x00000172CC320000-0x00000172CC321000-memory.dmp
memory/2380-201-0x00000172CDB90000-0x00000172CEB90000-memory.dmp
memory/2380-203-0x00000172CDEA0000-0x00000172CDEB0000-memory.dmp
memory/2380-218-0x00000172CDB90000-0x00000172CEB90000-memory.dmp
memory/2380-230-0x00000172CDB90000-0x00000172CEB90000-memory.dmp
memory/2380-148-0x00000172CDB90000-0x00000172CEB90000-memory.dmp
memory/2680-77-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-75-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-129-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-130-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-131-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-134-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-140-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-141-0x000001FBED0C0000-0x000001FBED0D0000-memory.dmp
memory/2680-142-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-125-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-110-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-102-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-97-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-95-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-94-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-89-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-83-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-82-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-8-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-126-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-70-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-64-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-61-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-58-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-56-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-55-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-54-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-42-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-37-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-19-0x000001FBECC00000-0x000001FBEDC00000-memory.dmp
memory/2680-13-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/2680-12-0x000001FBECBE0000-0x000001FBECBE1000-memory.dmp
memory/3244-227-0x0000025D80280000-0x0000025D80290000-memory.dmp
memory/3244-228-0x0000025D80290000-0x0000025D802A0000-memory.dmp
memory/3244-229-0x0000025D80000000-0x0000025D81000000-memory.dmp
memory/3244-219-0x0000025D80000000-0x0000025D81000000-memory.dmp
memory/3244-231-0x0000025D80000000-0x0000025D81000000-memory.dmp