Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
31/05/2024, 09:56
General
- Target 9b9099ea755e24ed749632ab2202124d2eab9d754080ab95feee69dde9f14621.jar
- Size 452KB
- Sample240531-lyf9aaef73
- SHA256 9b9099ea755e24ed749632ab2202124d2eab9d754080ab95feee69dde9f14621
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\9b9099ea755e24ed749632ab2202124d2eab9d754080ab95feee69dde9f14621.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\9b9099ea755e24ed749632ab2202124d2eab9d754080ab95feee69dde9f14621.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\9b9099ea755e24ed749632ab2202124d2eab9d754080ab95feee69dde9f14621.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\9b9099ea755e24ed749632ab2202124d2eab9d754080ab95feee69dde9f14621.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\9b9099ea755e24ed749632ab2202124d2eab9d754080ab95feee69dde9f14621.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
9b9099ea755e24ed749632ab2202124d2eab9d754080ab95feee69dde9f14621.jar
jna3337860950922170573.dll
83aa4cc77f591dfc2374580bbd95f6ba_310807ab-751f-4d81-ae09-b202eaf21e19
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/2608-264-0x000001F4D18A0000-0x000001F4D18A1000-memory.dmp
memory/3456-346-0x0000016A31330000-0x0000016A31331000-memory.dmp
memory/4876-108-0x0000013DA6250000-0x0000013DA6260000-memory.dmp
memory/4876-163-0x0000013DA6270000-0x0000013DA6280000-memory.dmp
memory/4876-27-0x0000013DA60C0000-0x0000013DA60D0000-memory.dmp
memory/4876-31-0x0000013DA60E0000-0x0000013DA60F0000-memory.dmp
memory/4876-30-0x0000013DA60D0000-0x0000013DA60E0000-memory.dmp
memory/4876-36-0x0000013DA6100000-0x0000013DA6110000-memory.dmp
memory/4876-35-0x0000013DA60F0000-0x0000013DA6100000-memory.dmp
memory/4876-41-0x0000013DA5DC0000-0x0000013DA5DC1000-memory.dmp
memory/4876-39-0x0000013DA6120000-0x0000013DA6130000-memory.dmp
memory/4876-38-0x0000013DA6110000-0x0000013DA6120000-memory.dmp
memory/4876-43-0x0000013DA5DE0000-0x0000013DA6050000-memory.dmp
memory/4876-44-0x0000013DA6130000-0x0000013DA6140000-memory.dmp
memory/4876-46-0x0000013DA6140000-0x0000013DA6150000-memory.dmp
memory/4876-45-0x0000013DA6050000-0x0000013DA6060000-memory.dmp
memory/4876-49-0x0000013DA6150000-0x0000013DA6160000-memory.dmp
memory/4876-48-0x0000013DA6060000-0x0000013DA6070000-memory.dmp
memory/4876-52-0x0000013DA6080000-0x0000013DA6090000-memory.dmp
memory/4876-54-0x0000013DA6160000-0x0000013DA6170000-memory.dmp
memory/4876-53-0x0000013DA6090000-0x0000013DA60A0000-memory.dmp
memory/4876-51-0x0000013DA6070000-0x0000013DA6080000-memory.dmp
memory/4876-61-0x0000013DA60A0000-0x0000013DA60B0000-memory.dmp
memory/4876-64-0x0000013DA6180000-0x0000013DA6190000-memory.dmp
memory/4876-63-0x0000013DA6170000-0x0000013DA6180000-memory.dmp
memory/4876-62-0x0000013DA60B0000-0x0000013DA60C0000-memory.dmp
memory/4876-67-0x0000013DA6190000-0x0000013DA61A0000-memory.dmp
memory/4876-73-0x0000013DA61A0000-0x0000013DA61B0000-memory.dmp
memory/4876-72-0x0000013DA60F0000-0x0000013DA6100000-memory.dmp
memory/4876-71-0x0000013DA60E0000-0x0000013DA60F0000-memory.dmp
memory/4876-70-0x0000013DA60D0000-0x0000013DA60E0000-memory.dmp
memory/4876-66-0x0000013DA60C0000-0x0000013DA60D0000-memory.dmp
memory/4876-75-0x0000013DA61B0000-0x0000013DA61C0000-memory.dmp
memory/4876-77-0x0000013DA61C0000-0x0000013DA61D0000-memory.dmp
memory/4876-76-0x0000013DA6100000-0x0000013DA6110000-memory.dmp
memory/4876-84-0x0000013DA61E0000-0x0000013DA61F0000-memory.dmp
memory/4876-82-0x0000013DA61D0000-0x0000013DA61E0000-memory.dmp
memory/4876-81-0x0000013DA6120000-0x0000013DA6130000-memory.dmp
memory/4876-80-0x0000013DA6110000-0x0000013DA6120000-memory.dmp
memory/4876-88-0x0000013DA61F0000-0x0000013DA6200000-memory.dmp
memory/4876-87-0x0000013DA6130000-0x0000013DA6140000-memory.dmp
memory/4876-90-0x0000013DA5DC0000-0x0000013DA5DC1000-memory.dmp
memory/4876-91-0x0000013DA6140000-0x0000013DA6150000-memory.dmp
memory/4876-92-0x0000013DA6200000-0x0000013DA6210000-memory.dmp
memory/4876-96-0x0000013DA6150000-0x0000013DA6160000-memory.dmp
memory/4876-98-0x0000013DA6210000-0x0000013DA6220000-memory.dmp
memory/4876-109-0x0000013DA6260000-0x0000013DA6270000-memory.dmp
memory/4876-24-0x0000013DA60A0000-0x0000013DA60B0000-memory.dmp
memory/4876-117-0x0000013DA6290000-0x0000013DA62A0000-memory.dmp
memory/4876-119-0x0000013DA5DC0000-0x0000013DA5DC1000-memory.dmp
memory/4876-116-0x0000013DA6280000-0x0000013DA6290000-memory.dmp
memory/4876-115-0x0000013DA6270000-0x0000013DA6280000-memory.dmp
memory/4876-25-0x0000013DA60B0000-0x0000013DA60C0000-memory.dmp
memory/4876-114-0x0000013DA6180000-0x0000013DA6190000-memory.dmp
memory/4876-174-0x0000013DA5DC0000-0x0000013DA5DC1000-memory.dmp
memory/4876-106-0x0000013DA6230000-0x0000013DA6240000-memory.dmp
memory/4876-105-0x0000013DA6220000-0x0000013DA6230000-memory.dmp
memory/4876-104-0x0000013DA6160000-0x0000013DA6170000-memory.dmp
memory/4876-127-0x0000013DA62A0000-0x0000013DA62B0000-memory.dmp
memory/4876-130-0x0000013DA62B0000-0x0000013DA62C0000-memory.dmp
memory/4876-129-0x0000013DA61A0000-0x0000013DA61B0000-memory.dmp
memory/4876-128-0x0000013DA62C0000-0x0000013DA62D0000-memory.dmp
memory/4876-124-0x0000013DA6190000-0x0000013DA61A0000-memory.dmp
memory/4876-123-0x0000013DA5DC0000-0x0000013DA5DC1000-memory.dmp
memory/4876-133-0x0000013DA62D0000-0x0000013DA62E0000-memory.dmp
memory/4876-132-0x0000013DA61B0000-0x0000013DA61C0000-memory.dmp
memory/4876-136-0x0000013DA62E0000-0x0000013DA62F0000-memory.dmp
memory/4876-135-0x0000013DA61C0000-0x0000013DA61D0000-memory.dmp
memory/4876-141-0x0000013DA62F0000-0x0000013DA6300000-memory.dmp
memory/4876-140-0x0000013DA61E0000-0x0000013DA61F0000-memory.dmp
memory/4876-139-0x0000013DA61D0000-0x0000013DA61E0000-memory.dmp
memory/4876-143-0x0000013DA6300000-0x0000013DA6310000-memory.dmp
memory/4876-142-0x0000013DA61F0000-0x0000013DA6200000-memory.dmp
memory/4876-146-0x0000013DA6310000-0x0000013DA6320000-memory.dmp
memory/4876-145-0x0000013DA6200000-0x0000013DA6210000-memory.dmp
memory/4876-149-0x0000013DA6320000-0x0000013DA6330000-memory.dmp
memory/4876-148-0x0000013DA6210000-0x0000013DA6220000-memory.dmp
memory/4876-152-0x0000013DA5DC0000-0x0000013DA5DC1000-memory.dmp
memory/4876-156-0x0000013DA6220000-0x0000013DA6230000-memory.dmp
memory/4876-159-0x0000013DA6250000-0x0000013DA6260000-memory.dmp
memory/4876-161-0x0000013DA6330000-0x0000013DA6340000-memory.dmp
memory/4876-160-0x0000013DA6260000-0x0000013DA6270000-memory.dmp
memory/4876-158-0x0000013DA6240000-0x0000013DA6250000-memory.dmp
memory/4876-157-0x0000013DA6230000-0x0000013DA6240000-memory.dmp
memory/4876-167-0x0000013DA6340000-0x0000013DA6350000-memory.dmp
memory/4876-166-0x0000013DA62A0000-0x0000013DA62B0000-memory.dmp
memory/4876-165-0x0000013DA6290000-0x0000013DA62A0000-memory.dmp
memory/4876-164-0x0000013DA6280000-0x0000013DA6290000-memory.dmp
memory/4876-113-0x0000013DA6170000-0x0000013DA6180000-memory.dmp
memory/4876-107-0x0000013DA6240000-0x0000013DA6250000-memory.dmp
memory/4876-176-0x0000013DA62C0000-0x0000013DA62D0000-memory.dmp
memory/4876-180-0x0000013DA6350000-0x0000013DA6360000-memory.dmp
memory/4876-179-0x0000013DA62B0000-0x0000013DA62C0000-memory.dmp
memory/4876-181-0x0000013DA5DC0000-0x0000013DA5DC1000-memory.dmp
memory/4876-182-0x0000013DA5DE0000-0x0000013DA6050000-memory.dmp
memory/4876-186-0x0000013DA6080000-0x0000013DA6090000-memory.dmp
memory/4876-16-0x0000013DA6060000-0x0000013DA6070000-memory.dmp
memory/4876-20-0x0000013DA6080000-0x0000013DA6090000-memory.dmp
memory/4876-21-0x0000013DA6090000-0x0000013DA60A0000-memory.dmp
memory/4876-19-0x0000013DA6070000-0x0000013DA6080000-memory.dmp
memory/4876-14-0x0000013DA6050000-0x0000013DA6060000-memory.dmp
memory/4876-2-0x0000013DA5DE0000-0x0000013DA6050000-memory.dmp
memory/4876-185-0x0000013DA6070000-0x0000013DA6080000-memory.dmp
memory/4876-184-0x0000013DA6060000-0x0000013DA6070000-memory.dmp
memory/4876-183-0x0000013DA6050000-0x0000013DA6060000-memory.dmp