6fc494a717e1d8ca843578c7c19a27e4403eea0859393fda256d281cfa6f9535 | Triage

Submit
Reports

Overview

overview

Static

static

3

ExCheats Loader.exe

windows10-2004-x64

jre/Welcome.html

windows10-2004-x64

1

jre/bin/JA...32.dll

windows10-2004-x64

1

jre/bin/JA...ge.dll

windows10-2004-x64

1

jre/bin/Ja...32.dll

windows10-2004-x64

1

jre/bin/Ja...ge.dll

windows10-2004-x64

1

jre/bin/Wi...32.dll

windows10-2004-x64

3

jre/bin/Wi...ge.dll

windows10-2004-x64

3

jre/bin/awt.dll

windows10-2004-x64

1

jre/bin/bci.dll

windows10-2004-x64

3

jre/bin/cl...vm.dll

windows10-2004-x64

3

jre/bin/dcpr.dll

windows10-2004-x64

1

jre/bin/de...se.dll

windows10-2004-x64

3

jre/bin/deploy.dll

windows10-2004-x64

3

jre/bin/dt_shmem.dll

windows10-2004-x64

3

jre/bin/dt_socket.dll

windows10-2004-x64

1

jre/bin/dt...a1.dll

windows10-2004-x64

1

jre/bin/dt...a1.dll

windows10-2004-x64

3

jre/bin/eula.dll

windows10-2004-x64

1

jre/bin/fo...er.dll

windows10-2004-x64

1

jre/bin/fxplugins.dll

windows10-2004-x64

3

jre/bin/glass.dll

windows10-2004-x64

1

jre/bin/glib-lite.dll

windows10-2004-x64

3

jre/bin/gs...te.dll

windows10-2004-x64

3

jre/bin/hprof.dll

windows10-2004-x64

3

jre/bin/in...nt.dll

windows10-2004-x64

3

jre/bin/j2pcsc.dll

windows10-2004-x64

1

jre/bin/j2pkcs11.dll

windows10-2004-x64

1

jre/bin/jaas_nt.dll

windows10-2004-x64

3

jre/bin/jabswitch.exe

windows10-2004-x64

1

jre/bin/java-rmi.exe

windows10-2004-x64

1

jre/bin/java.dll

windows10-2004-x64

1

Analysis

max time kernel
1741s
max time network
1180s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:08

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ExCheats Loader.exe

Resource

win10v2004-20240412-en

redline zgrat discovery infostealer persistence rat spyware stealer

windows10-2004-x64

26 signatures

1800 seconds

Behavioral task

behavioral2

Sample

jre/Welcome.html

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

1800 seconds

Behavioral task

behavioral3

Sample

jre/bin/JAWTAccessBridge-32.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral4

Sample

jre/bin/JAWTAccessBridge.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral5

Sample

jre/bin/JavaAccessBridge-32.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral6

Sample

jre/bin/JavaAccessBridge.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral7

Sample

jre/bin/WindowsAccessBridge-32.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral8

Sample

jre/bin/WindowsAccessBridge.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral9

Sample

jre/bin/awt.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral10

Sample

jre/bin/bci.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral11

Sample

jre/bin/client/jvm.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral12

Sample

jre/bin/dcpr.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral13

Sample

jre/bin/decora_sse.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral14

Sample

jre/bin/deploy.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

3 signatures

1800 seconds

Behavioral task

behavioral15

Sample

jre/bin/dt_shmem.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral16

Sample

jre/bin/dt_socket.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral17

Sample

jre/bin/dtplugin/deployJava1.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral18

Sample

jre/bin/dtplugin/npdeployJava1.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral19

Sample

jre/bin/eula.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral20

Sample

jre/bin/fontmanager.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral21

Sample

jre/bin/fxplugins.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral22

Sample

jre/bin/glass.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral23

Sample

jre/bin/glib-lite.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

3 signatures

1800 seconds

Behavioral task

behavioral24

Sample

jre/bin/gstreamer-lite.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral25

Sample

jre/bin/hprof.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

3 signatures

1800 seconds

Behavioral task

behavioral26

Sample

jre/bin/instrument.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral27

Sample

jre/bin/j2pcsc.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral28

Sample

jre/bin/j2pkcs11.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral29

Sample

jre/bin/jaas_nt.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

2 signatures

1800 seconds

Behavioral task

behavioral30

Sample

jre/bin/jabswitch.exe

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral31

Sample

jre/bin/java-rmi.exe

Resource

win10v2004-20240412-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral32

Sample

jre/bin/java.dll

Resource

win10v2004-20240412-en

windows10-2004-x64

1 signatures

1800 seconds

Report Analysis Logs

General

Target

jre/bin/java-rmi.exe
Size

15KB
MD5

cf2f023d2b5f0bfb2ecf8aeea7c51481
SHA1

6eb867b1ac656a0fc363dfae4e2d582606d100fb
SHA256

355366d0c7d7406e2319c90df2080c0fae72d9d54e4563c48a09f55ca68d6b0c
SHA512

a2041925039238235adc5fe8a9b818dff577c6ea3c55a0de08da3dedd8cd50dc240432ba1a0aea5e8830dcdccd3bfbf9cf8a4f21e9b56dc839e074e156fc008d
SSDEEP

384:GpsbHnDiW6gejmSHhV8cGees7snYPLr7Wj53:GpsbHn/HS/8cresgC743

Score

1^/10

Malware Config

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\jre\bin\java-rmi.exe
"C:\Users\Admin\AppData\Local\Temp\jre\bin\java-rmi.exe"
1⤵
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-10-0x0000000002840000-0x0000000004840000-memory.dmp

Filesize
32.0MB

Download
memory/1476-18-0x0000000002840000-0x0000000004840000-memory.dmp

Filesize
32.0MB

Download
memory/1476-25-0x0000000002840000-0x0000000004840000-memory.dmp

Filesize
32.0MB

Download
memory/1476-30-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1476-31-0x0000000002840000-0x0000000004840000-memory.dmp

Filesize
32.0MB

Download
memory/1476-32-0x00000000028E8000-0x00000000028F0000-memory.dmp

Filesize
32KB

Download
memory/1476-33-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download
memory/1476-34-0x0000000002840000-0x0000000004840000-memory.dmp

Filesize
32.0MB

Download
memory/1476-35-0x0000000002840000-0x0000000004840000-memory.dmp

Filesize
32.0MB

Download

© 2018-2024

Terms | Privacy