Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/06/2024, 01:38
General
- Target ed41f1a75fc6e0e049e815903dac8c52e12ae6212103e9002206f0dd14ea44db.jar
- Size 208KB
- Sample240608-b2p1gsfc41
- SHA256 ed41f1a75fc6e0e049e815903dac8c52e12ae6212103e9002206f0dd14ea44db
Malware Config
Extracted
-
strrat
-
chongmei33.publicvm.com:44662
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ed41f1a75fc6e0e049e815903dac8c52e12ae6212103e9002206f0dd14ea44db.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\ed41f1a75fc6e0e049e815903dac8c52e12ae6212103e9002206f0dd14ea44db.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\ed41f1a75fc6e0e049e815903dac8c52e12ae6212103e9002206f0dd14ea44db.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\ed41f1a75fc6e0e049e815903dac8c52e12ae6212103e9002206f0dd14ea44db.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\ed41f1a75fc6e0e049e815903dac8c52e12ae6212103e9002206f0dd14ea44db.jar"3⤵
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3512 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna666668461595285144.dll
83aa4cc77f591dfc2374580bbd95f6ba_2397ee06-28fe-4eaa-8777-f7014368c353
ed41f1a75fc6e0e049e815903dac8c52e12ae6212103e9002206f0dd14ea44db.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/4008-294-0x000001952A2D0000-0x000001952A2D1000-memory.dmp
memory/4508-240-0x000001A5B48E0000-0x000001A5B48E1000-memory.dmp
memory/4620-142-0x0000018C00370000-0x0000018C00380000-memory.dmp
memory/4620-186-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-27-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-26-0x0000018C002D0000-0x0000018C002E0000-memory.dmp
memory/4620-29-0x0000018C002E0000-0x0000018C002F0000-memory.dmp
memory/4620-35-0x0000018C00000000-0x0000018C00270000-memory.dmp
memory/4620-36-0x0000018C002F0000-0x0000018C00300000-memory.dmp
memory/4620-40-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-39-0x0000018C00300000-0x0000018C00310000-memory.dmp
memory/4620-42-0x0000018C00310000-0x0000018C00320000-memory.dmp
memory/4620-41-0x0000018C00270000-0x0000018C00280000-memory.dmp
memory/4620-45-0x0000018C00320000-0x0000018C00330000-memory.dmp
memory/4620-44-0x0000018C00280000-0x0000018C00290000-memory.dmp
memory/4620-50-0x0000018C00340000-0x0000018C00350000-memory.dmp
memory/4620-49-0x0000018C00330000-0x0000018C00340000-memory.dmp
memory/4620-57-0x0000018C00370000-0x0000018C00380000-memory.dmp
memory/4620-56-0x0000018C00360000-0x0000018C00370000-memory.dmp
memory/4620-55-0x0000018C00350000-0x0000018C00360000-memory.dmp
memory/4620-54-0x0000018C002A0000-0x0000018C002B0000-memory.dmp
memory/4620-48-0x0000018C00290000-0x0000018C002A0000-memory.dmp
memory/4620-63-0x0000018C00380000-0x0000018C00390000-memory.dmp
memory/4620-62-0x0000018C002B0000-0x0000018C002C0000-memory.dmp
memory/4620-66-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-67-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-73-0x0000018C00390000-0x0000018C003A0000-memory.dmp
memory/4620-72-0x0000018C002C0000-0x0000018C002D0000-memory.dmp
memory/4620-78-0x0000018C003A0000-0x0000018C003B0000-memory.dmp
memory/4620-77-0x0000018C002D0000-0x0000018C002E0000-memory.dmp
memory/4620-86-0x0000018C003B0000-0x0000018C003C0000-memory.dmp
memory/4620-85-0x0000018C002E0000-0x0000018C002F0000-memory.dmp
memory/4620-87-0x0000018C002F0000-0x0000018C00300000-memory.dmp
memory/4620-91-0x0000018C003C0000-0x0000018C003D0000-memory.dmp
memory/4620-94-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-100-0x0000018C00300000-0x0000018C00310000-memory.dmp
memory/4620-101-0x0000018C003D0000-0x0000018C003E0000-memory.dmp
memory/4620-106-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-119-0x0000018C003F0000-0x0000018C00400000-memory.dmp
memory/4620-116-0x0000018C003E0000-0x0000018C003F0000-memory.dmp
memory/4620-128-0x0000018C00420000-0x0000018C00430000-memory.dmp
memory/4620-127-0x0000018C00340000-0x0000018C00350000-memory.dmp
memory/4620-126-0x0000018C00330000-0x0000018C00340000-memory.dmp
memory/4620-125-0x0000018C00410000-0x0000018C00420000-memory.dmp
memory/4620-122-0x0000018C00400000-0x0000018C00410000-memory.dmp
memory/4620-136-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-135-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-134-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-121-0x0000018C00320000-0x0000018C00330000-memory.dmp
memory/4620-115-0x0000018C00310000-0x0000018C00320000-memory.dmp
memory/4620-138-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-140-0x0000018C00350000-0x0000018C00360000-memory.dmp
memory/4620-143-0x0000018C00430000-0x0000018C00440000-memory.dmp
memory/4620-24-0x0000018C002C0000-0x0000018C002D0000-memory.dmp
memory/4620-141-0x0000018C00360000-0x0000018C00370000-memory.dmp
memory/4620-145-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-146-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-154-0x0000018C00390000-0x0000018C003A0000-memory.dmp
memory/4620-23-0x0000018C002B0000-0x0000018C002C0000-memory.dmp
memory/4620-152-0x0000018C00460000-0x0000018C00470000-memory.dmp
memory/4620-156-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-151-0x0000018C00440000-0x0000018C00450000-memory.dmp
memory/4620-150-0x0000018C00380000-0x0000018C00390000-memory.dmp
memory/4620-161-0x0000018C003A0000-0x0000018C003B0000-memory.dmp
memory/4620-171-0x0000018C00490000-0x0000018C004A0000-memory.dmp
memory/4620-170-0x0000018C003B0000-0x0000018C003C0000-memory.dmp
memory/4620-169-0x0000018C004A0000-0x0000018C004B0000-memory.dmp
memory/4620-168-0x0000018C00480000-0x0000018C00490000-memory.dmp
memory/4620-167-0x0000018C00470000-0x0000018C00480000-memory.dmp
memory/4620-162-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-181-0x0000018C003D0000-0x0000018C003E0000-memory.dmp
memory/4620-180-0x0000018C004C0000-0x0000018C004D0000-memory.dmp
memory/4620-179-0x0000018C004B0000-0x0000018C004C0000-memory.dmp
memory/4620-178-0x0000018C003C0000-0x0000018C003D0000-memory.dmp
memory/4620-184-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-153-0x0000018C00450000-0x0000018C00460000-memory.dmp
memory/4620-187-0x0000018C00000000-0x0000018C00270000-memory.dmp
memory/4620-192-0x0000018C002B0000-0x0000018C002C0000-memory.dmp
memory/4620-219-0x0000018C004A0000-0x0000018C004B0000-memory.dmp
memory/4620-218-0x0000018C00480000-0x0000018C00490000-memory.dmp
memory/4620-217-0x0000018C00490000-0x0000018C004A0000-memory.dmp
memory/4620-216-0x0000018C00380000-0x0000018C00390000-memory.dmp
memory/4620-215-0x0000018C00460000-0x0000018C00470000-memory.dmp
memory/4620-214-0x0000018C00440000-0x0000018C00450000-memory.dmp
memory/4620-213-0x0000018C00430000-0x0000018C00440000-memory.dmp
memory/4620-212-0x0000018C00410000-0x0000018C00420000-memory.dmp
memory/4620-211-0x0000018C00420000-0x0000018C00430000-memory.dmp
memory/4620-210-0x0000018C00400000-0x0000018C00410000-memory.dmp
memory/4620-209-0x0000018C003F0000-0x0000018C00400000-memory.dmp
memory/4620-208-0x0000018C003E0000-0x0000018C003F0000-memory.dmp
memory/4620-207-0x0000018C003A0000-0x0000018C003B0000-memory.dmp
memory/4620-206-0x0000018C00390000-0x0000018C003A0000-memory.dmp
memory/4620-205-0x0000018C00450000-0x0000018C00460000-memory.dmp
memory/4620-204-0x0000018C00370000-0x0000018C00380000-memory.dmp
memory/4620-203-0x0000018C00360000-0x0000018C00370000-memory.dmp
memory/4620-202-0x0000018C00350000-0x0000018C00360000-memory.dmp
memory/4620-201-0x0000018C00340000-0x0000018C00350000-memory.dmp
memory/4620-200-0x0000018C00330000-0x0000018C00340000-memory.dmp
memory/4620-199-0x0000018C00320000-0x0000018C00330000-memory.dmp
memory/4620-198-0x0000018C00310000-0x0000018C00320000-memory.dmp
memory/4620-197-0x0000018C00300000-0x0000018C00310000-memory.dmp
memory/4620-196-0x0000018C002F0000-0x0000018C00300000-memory.dmp
memory/4620-195-0x0000018C002E0000-0x0000018C002F0000-memory.dmp
memory/4620-194-0x0000018C002D0000-0x0000018C002E0000-memory.dmp
memory/4620-193-0x0000018C002C0000-0x0000018C002D0000-memory.dmp
memory/4620-20-0x0000018C002A0000-0x0000018C002B0000-memory.dmp
memory/4620-18-0x0000018C00290000-0x0000018C002A0000-memory.dmp
memory/4620-17-0x0000018C00280000-0x0000018C00290000-memory.dmp
memory/4620-14-0x0000018C00270000-0x0000018C00280000-memory.dmp
memory/4620-11-0x0000018C786C0000-0x0000018C786C1000-memory.dmp
memory/4620-2-0x0000018C00000000-0x0000018C00270000-memory.dmp
memory/4620-191-0x0000018C002A0000-0x0000018C002B0000-memory.dmp
memory/4620-190-0x0000018C00290000-0x0000018C002A0000-memory.dmp
memory/4620-189-0x0000018C00280000-0x0000018C00290000-memory.dmp
memory/4620-188-0x0000018C00270000-0x0000018C00280000-memory.dmp