Analysis
- max time kernel
1801s - max time network
1791s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
09/04/2024, 13:34
General
- Target 14052163e50c197697c64b143.exe
- Size 17.6MB
- Sample240409-qvlrtabe9s
- SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
Malware Config
Extracted
-
strrat
-
rar.ydns.eu:9999
-
svchost.ydns.eu:10000
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
false
-
secondary_startup
false
-
startup
true
Extracted
-
ps1
-
ps1.dropper
https://files.catbox.moe/fvl5hy.jpg
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Blocklisted process makes network request 64 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 43 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txtC:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 05⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 05⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
-
-
-
C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
rrrrrrrr.ps1
32.exe
64.exe
Antimalware Service Executable.JS
CL_Debug_Log.txt
CR_Debug_Log.txt
EmbraTor Mac Smash Bullet.exe
Java Install.jar
MsMpEng.js
SystemCheck.xml
Windows Driver Foundation.vbs
__PSScriptPolicyTest_mz5dzwja.ebo.psm1
aut8131.tmp
x.exe
memory/1416-203-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/1416-228-0x0000000001BC0000-0x0000000001BC1000-memory.dmp
memory/1416-241-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/1416-231-0x0000000001BE0000-0x0000000001BE1000-memory.dmp
memory/1416-230-0x0000000001BD0000-0x0000000001BD1000-memory.dmp
memory/1416-227-0x0000000001BB0000-0x0000000001BB1000-memory.dmp
memory/1416-200-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/1416-191-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/1416-176-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/1416-158-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/1416-101-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/1416-146-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/1416-129-0x0000000000880000-0x0000000001AA6000-memory.dmp
memory/3428-114-0x000002F0E90C0000-0x000002F0E90C1000-memory.dmp
memory/3428-95-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-248-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-247-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-245-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-103-0x000002F0E90C0000-0x000002F0E90C1000-memory.dmp
memory/3428-155-0x000002F0E90C0000-0x000002F0E90C1000-memory.dmp
memory/3428-153-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-119-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-62-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-168-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-244-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-243-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-242-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-28-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/3428-36-0x000002F0E90C0000-0x000002F0E90C1000-memory.dmp
memory/3428-73-0x000002F0E90C0000-0x000002F0E90C1000-memory.dmp
memory/3428-79-0x000002F0EAB30000-0x000002F0EBB30000-memory.dmp
memory/4440-99-0x0000000008850000-0x00000000088C6000-memory.dmp
memory/4440-42-0x0000000072F40000-0x000000007362E000-memory.dmp
memory/4440-60-0x0000000007E90000-0x0000000007EF6000-memory.dmp
memory/4440-205-0x0000000004E30000-0x0000000004E40000-memory.dmp
memory/4440-43-0x0000000004CD0000-0x0000000004D06000-memory.dmp
memory/4440-44-0x0000000004E30000-0x0000000004E40000-memory.dmp
memory/4440-202-0x0000000003190000-0x00000000031AA000-memory.dmp
memory/4440-236-0x0000000072F40000-0x000000007362E000-memory.dmp
memory/4440-201-0x0000000009ED0000-0x000000000A548000-memory.dmp
memory/4440-64-0x00000000080F0000-0x0000000008440000-memory.dmp
memory/4440-87-0x00000000077B0000-0x00000000077CC000-memory.dmp
memory/4440-90-0x0000000008030000-0x000000000807B000-memory.dmp
memory/4440-47-0x0000000004E30000-0x0000000004E40000-memory.dmp
memory/4440-46-0x00000000077F0000-0x0000000007E18000-memory.dmp
memory/4440-58-0x0000000007E20000-0x0000000007E86000-memory.dmp
memory/4440-50-0x0000000007690000-0x00000000076B2000-memory.dmp