Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 03:17
General
- Target 0f359450e399eff8b4b9ae323a4e7a6569426735f3824a13756972f1b10d2606.jar
- Size 481KB
- Sample240604-dtg11sca47
- SHA256 0f359450e399eff8b4b9ae323a4e7a6569426735f3824a13756972f1b10d2606
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\0f359450e399eff8b4b9ae323a4e7a6569426735f3824a13756972f1b10d2606.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\0f359450e399eff8b4b9ae323a4e7a6569426735f3824a13756972f1b10d2606.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0f359450e399eff8b4b9ae323a4e7a6569426735f3824a13756972f1b10d2606.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0f359450e399eff8b4b9ae323a4e7a6569426735f3824a13756972f1b10d2606.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\0f359450e399eff8b4b9ae323a4e7a6569426735f3824a13756972f1b10d2606.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
0f359450e399eff8b4b9ae323a4e7a6569426735f3824a13756972f1b10d2606.jar
jna7876668275213699419.dll
83aa4cc77f591dfc2374580bbd95f6ba_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/644-101-0x0000024880380000-0x0000024880390000-memory.dmp
memory/644-16-0x0000024880280000-0x0000024880290000-memory.dmp
memory/644-25-0x00000248FE050000-0x00000248FE051000-memory.dmp
memory/644-26-0x00000248802D0000-0x00000248802E0000-memory.dmp
memory/644-21-0x00000248802A0000-0x00000248802B0000-memory.dmp
memory/644-28-0x00000248802E0000-0x00000248802F0000-memory.dmp
memory/644-30-0x00000248802F0000-0x0000024880300000-memory.dmp
memory/644-38-0x0000024880320000-0x0000024880330000-memory.dmp
memory/644-40-0x0000024880340000-0x0000024880350000-memory.dmp
memory/644-39-0x0000024880330000-0x0000024880340000-memory.dmp
memory/644-37-0x0000024880310000-0x0000024880320000-memory.dmp
memory/644-33-0x0000024880300000-0x0000024880310000-memory.dmp
memory/644-46-0x0000024880270000-0x0000024880280000-memory.dmp
memory/644-45-0x0000024880360000-0x0000024880370000-memory.dmp
memory/644-44-0x0000024880350000-0x0000024880360000-memory.dmp
memory/644-43-0x0000024880000000-0x0000024880270000-memory.dmp
memory/644-50-0x00000248802B0000-0x00000248802C0000-memory.dmp
memory/644-52-0x0000024880370000-0x0000024880380000-memory.dmp
memory/644-49-0x0000024880290000-0x00000248802A0000-memory.dmp
memory/644-48-0x0000024880280000-0x0000024880290000-memory.dmp
memory/644-54-0x0000024880380000-0x0000024880390000-memory.dmp
memory/644-53-0x00000248802A0000-0x00000248802B0000-memory.dmp
memory/644-61-0x00000248802C0000-0x00000248802D0000-memory.dmp
memory/644-62-0x0000024880390000-0x00000248803A0000-memory.dmp
memory/644-66-0x00000248803B0000-0x00000248803C0000-memory.dmp
memory/644-65-0x00000248803A0000-0x00000248803B0000-memory.dmp
memory/644-64-0x00000248802D0000-0x00000248802E0000-memory.dmp
memory/644-69-0x00000248802E0000-0x00000248802F0000-memory.dmp
memory/644-70-0x00000248803C0000-0x00000248803D0000-memory.dmp
memory/644-71-0x00000248802F0000-0x0000024880300000-memory.dmp
memory/644-72-0x00000248803D0000-0x00000248803E0000-memory.dmp
memory/644-75-0x0000024880300000-0x0000024880310000-memory.dmp
memory/644-76-0x00000248803E0000-0x00000248803F0000-memory.dmp
memory/644-81-0x0000024880340000-0x0000024880350000-memory.dmp
memory/644-82-0x00000248803F0000-0x0000024880400000-memory.dmp
memory/644-80-0x0000024880330000-0x0000024880340000-memory.dmp
memory/644-79-0x0000024880320000-0x0000024880330000-memory.dmp
memory/644-78-0x0000024880310000-0x0000024880320000-memory.dmp
memory/644-85-0x0000024880400000-0x0000024880410000-memory.dmp
memory/644-84-0x0000024880350000-0x0000024880360000-memory.dmp
memory/644-89-0x0000024880420000-0x0000024880430000-memory.dmp
memory/644-88-0x0000024880410000-0x0000024880420000-memory.dmp
memory/644-87-0x0000024880360000-0x0000024880370000-memory.dmp
memory/644-94-0x00000248FE050000-0x00000248FE051000-memory.dmp
memory/644-95-0x0000024880370000-0x0000024880380000-memory.dmp
memory/644-97-0x0000024880440000-0x0000024880450000-memory.dmp
memory/644-98-0x00000248FE050000-0x00000248FE051000-memory.dmp
memory/644-96-0x0000024880430000-0x0000024880440000-memory.dmp
memory/644-102-0x0000024880450000-0x0000024880460000-memory.dmp
memory/644-22-0x00000248802B0000-0x00000248802C0000-memory.dmp
memory/644-106-0x0000024880390000-0x00000248803A0000-memory.dmp
memory/644-108-0x0000024880460000-0x0000024880470000-memory.dmp
memory/644-23-0x00000248802C0000-0x00000248802D0000-memory.dmp
memory/644-116-0x0000024880480000-0x0000024880490000-memory.dmp
memory/644-119-0x00000248804A0000-0x00000248804B0000-memory.dmp
memory/644-124-0x00000248804D0000-0x00000248804E0000-memory.dmp
memory/644-121-0x00000248803C0000-0x00000248803D0000-memory.dmp
memory/644-120-0x00000248804B0000-0x00000248804C0000-memory.dmp
memory/644-127-0x00000248FE050000-0x00000248FE051000-memory.dmp
memory/644-123-0x00000248803D0000-0x00000248803E0000-memory.dmp
memory/644-118-0x0000024880490000-0x00000248804A0000-memory.dmp
memory/644-115-0x00000248803B0000-0x00000248803C0000-memory.dmp
memory/644-114-0x00000248803A0000-0x00000248803B0000-memory.dmp
memory/644-109-0x0000024880470000-0x0000024880480000-memory.dmp
memory/644-130-0x00000248FE050000-0x00000248FE051000-memory.dmp
memory/644-132-0x00000248803E0000-0x00000248803F0000-memory.dmp
memory/644-133-0x00000248804E0000-0x00000248804F0000-memory.dmp
memory/644-136-0x00000248804F0000-0x0000024880500000-memory.dmp
memory/644-135-0x00000248803F0000-0x0000024880400000-memory.dmp
memory/644-138-0x0000024880400000-0x0000024880410000-memory.dmp
memory/644-140-0x0000024880500000-0x0000024880510000-memory.dmp
memory/644-142-0x0000024880420000-0x0000024880430000-memory.dmp
memory/644-143-0x0000024880510000-0x0000024880520000-memory.dmp
memory/644-141-0x0000024880410000-0x0000024880420000-memory.dmp
memory/644-145-0x0000024880430000-0x0000024880440000-memory.dmp
memory/644-146-0x0000024880440000-0x0000024880450000-memory.dmp
memory/644-147-0x0000024880520000-0x0000024880530000-memory.dmp
memory/644-149-0x0000024880450000-0x0000024880460000-memory.dmp
memory/644-150-0x0000024880530000-0x0000024880540000-memory.dmp
memory/644-155-0x0000024880540000-0x0000024880550000-memory.dmp
memory/644-154-0x0000024880480000-0x0000024880490000-memory.dmp
memory/644-153-0x0000024880470000-0x0000024880480000-memory.dmp
memory/644-152-0x0000024880460000-0x0000024880470000-memory.dmp
memory/644-158-0x00000248FE050000-0x00000248FE051000-memory.dmp
memory/644-161-0x0000024880490000-0x00000248804A0000-memory.dmp
memory/644-162-0x00000248804A0000-0x00000248804B0000-memory.dmp
memory/644-163-0x0000024880550000-0x0000024880560000-memory.dmp
memory/644-169-0x0000024880560000-0x0000024880570000-memory.dmp
memory/644-167-0x00000248804B0000-0x00000248804C0000-memory.dmp
memory/644-168-0x00000248804C0000-0x00000248804D0000-memory.dmp
memory/644-173-0x00000248FE050000-0x00000248FE051000-memory.dmp
memory/644-175-0x0000024880570000-0x0000024880580000-memory.dmp
memory/644-174-0x00000248804D0000-0x00000248804E0000-memory.dmp
memory/644-180-0x00000248FE050000-0x00000248FE051000-memory.dmp
memory/644-181-0x00000248804E0000-0x00000248804F0000-memory.dmp
memory/644-186-0x0000024880590000-0x00000248805A0000-memory.dmp
memory/644-122-0x00000248804C0000-0x00000248804D0000-memory.dmp
memory/644-187-0x0000024880500000-0x0000024880510000-memory.dmp
memory/644-185-0x0000024880580000-0x0000024880590000-memory.dmp
memory/644-184-0x00000248804F0000-0x0000024880500000-memory.dmp
memory/644-189-0x0000024880360000-0x0000024880370000-memory.dmp
memory/644-2-0x0000024880000000-0x0000024880270000-memory.dmp
memory/644-13-0x0000024880270000-0x0000024880280000-memory.dmp
memory/644-17-0x0000024880290000-0x00000248802A0000-memory.dmp
memory/1180-325-0x0000019418710000-0x0000019418711000-memory.dmp
memory/1180-279-0x0000019418710000-0x0000019418711000-memory.dmp
memory/2496-391-0x00000231DCF70000-0x00000231DCF71000-memory.dmp