Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
08/06/2024, 07:18
General
- Target 3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar
- Size 481KB
- Sample240608-h5a43aba93
- SHA256 3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar
jna6498212639237933190.dll
83aa4cc77f591dfc2374580bbd95f6ba_215f2dba-ef84-4dd1-b127-5f514a0c233b
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/4004-298-0x0000017A611E0000-0x0000017A611E1000-memory.dmp
memory/4700-367-0x000002436C240000-0x000002436C241000-memory.dmp
memory/4748-106-0x00000253B7FE0000-0x00000253B7FF0000-memory.dmp
memory/4748-169-0x00000253B80C0000-0x00000253B80D0000-memory.dmp
memory/4748-28-0x00000253B7E40000-0x00000253B7E50000-memory.dmp
memory/4748-30-0x00000253B7E50000-0x00000253B7E60000-memory.dmp
memory/4748-37-0x00000253B7E70000-0x00000253B7E80000-memory.dmp
memory/4748-35-0x00000253B7E60000-0x00000253B7E70000-memory.dmp
memory/4748-38-0x00000253B7E90000-0x00000253B7EA0000-memory.dmp
memory/4748-34-0x00000253B7E80000-0x00000253B7E90000-memory.dmp
memory/4748-33-0x00000253B7B60000-0x00000253B7DD0000-memory.dmp
memory/4748-41-0x00000253B7EA0000-0x00000253B7EB0000-memory.dmp
memory/4748-40-0x00000253B7DD0000-0x00000253B7DE0000-memory.dmp
memory/4748-42-0x00000253B6360000-0x00000253B6361000-memory.dmp
memory/4748-46-0x00000253B7EB0000-0x00000253B7EC0000-memory.dmp
memory/4748-45-0x00000253B7DF0000-0x00000253B7E00000-memory.dmp
memory/4748-44-0x00000253B7DE0000-0x00000253B7DF0000-memory.dmp
memory/4748-48-0x00000253B7E00000-0x00000253B7E10000-memory.dmp
memory/4748-49-0x00000253B7EC0000-0x00000253B7ED0000-memory.dmp
memory/4748-54-0x00000253B7E10000-0x00000253B7E20000-memory.dmp
memory/4748-55-0x00000253B7ED0000-0x00000253B7EE0000-memory.dmp
memory/4748-63-0x00000253B7F00000-0x00000253B7F10000-memory.dmp
memory/4748-62-0x00000253B7EF0000-0x00000253B7F00000-memory.dmp
memory/4748-61-0x00000253B7EE0000-0x00000253B7EF0000-memory.dmp
memory/4748-60-0x00000253B7E20000-0x00000253B7E30000-memory.dmp
memory/4748-77-0x00000253B7E40000-0x00000253B7E50000-memory.dmp
memory/4748-76-0x00000253B7F60000-0x00000253B7F70000-memory.dmp
memory/4748-75-0x00000253B7F50000-0x00000253B7F60000-memory.dmp
memory/4748-74-0x00000253B7F40000-0x00000253B7F50000-memory.dmp
memory/4748-73-0x00000253B7F30000-0x00000253B7F40000-memory.dmp
memory/4748-72-0x00000253B7F20000-0x00000253B7F30000-memory.dmp
memory/4748-71-0x00000253B7F10000-0x00000253B7F20000-memory.dmp
memory/4748-70-0x00000253B7E30000-0x00000253B7E40000-memory.dmp
memory/4748-80-0x00000253B7E50000-0x00000253B7E60000-memory.dmp
memory/4748-82-0x00000253B7F70000-0x00000253B7F80000-memory.dmp
memory/4748-81-0x00000253B7E80000-0x00000253B7E90000-memory.dmp
memory/4748-87-0x00000253B7E70000-0x00000253B7E80000-memory.dmp
memory/4748-90-0x00000253B7E90000-0x00000253B7EA0000-memory.dmp
memory/4748-89-0x00000253B7F90000-0x00000253B7FA0000-memory.dmp
memory/4748-88-0x00000253B7F80000-0x00000253B7F90000-memory.dmp
memory/4748-86-0x00000253B7E60000-0x00000253B7E70000-memory.dmp
memory/4748-91-0x00000253B6360000-0x00000253B6361000-memory.dmp
memory/4748-95-0x00000253B7FA0000-0x00000253B7FB0000-memory.dmp
memory/4748-94-0x00000253B7EA0000-0x00000253B7EB0000-memory.dmp
memory/4748-99-0x00000253B7FB0000-0x00000253B7FC0000-memory.dmp
memory/4748-98-0x00000253B7EB0000-0x00000253B7EC0000-memory.dmp
memory/4748-103-0x00000253B7EC0000-0x00000253B7ED0000-memory.dmp
memory/4748-23-0x00000253B7E20000-0x00000253B7E30000-memory.dmp
memory/4748-105-0x00000253B7FD0000-0x00000253B7FE0000-memory.dmp
memory/4748-104-0x00000253B7FC0000-0x00000253B7FD0000-memory.dmp
memory/4748-111-0x00000253B7ED0000-0x00000253B7EE0000-memory.dmp
memory/4748-114-0x00000253B8010000-0x00000253B8020000-memory.dmp
memory/4748-25-0x00000253B7E30000-0x00000253B7E40000-memory.dmp
memory/4748-113-0x00000253B8000000-0x00000253B8010000-memory.dmp
memory/4748-172-0x00000253B80D0000-0x00000253B80E0000-memory.dmp
memory/4748-123-0x00000253B8020000-0x00000253B8030000-memory.dmp
memory/4748-122-0x00000253B7F00000-0x00000253B7F10000-memory.dmp
memory/4748-121-0x00000253B7EF0000-0x00000253B7F00000-memory.dmp
memory/4748-120-0x00000253B7EE0000-0x00000253B7EF0000-memory.dmp
memory/4748-124-0x00000253B6360000-0x00000253B6361000-memory.dmp
memory/4748-126-0x00000253B7F10000-0x00000253B7F20000-memory.dmp
memory/4748-131-0x00000253B8030000-0x00000253B8040000-memory.dmp
memory/4748-130-0x00000253B7F50000-0x00000253B7F60000-memory.dmp
memory/4748-129-0x00000253B7F40000-0x00000253B7F50000-memory.dmp
memory/4748-128-0x00000253B7F30000-0x00000253B7F40000-memory.dmp
memory/4748-127-0x00000253B7F20000-0x00000253B7F30000-memory.dmp
memory/4748-133-0x00000253B7F60000-0x00000253B7F70000-memory.dmp
memory/4748-134-0x00000253B8040000-0x00000253B8050000-memory.dmp
memory/4748-136-0x00000253B7F70000-0x00000253B7F80000-memory.dmp
memory/4748-137-0x00000253B8050000-0x00000253B8060000-memory.dmp
memory/4748-139-0x00000253B7F80000-0x00000253B7F90000-memory.dmp
memory/4748-140-0x00000253B8060000-0x00000253B8070000-memory.dmp
memory/4748-142-0x00000253B7F90000-0x00000253B7FA0000-memory.dmp
memory/4748-143-0x00000253B8070000-0x00000253B8080000-memory.dmp
memory/4748-146-0x00000253B8080000-0x00000253B8090000-memory.dmp
memory/4748-145-0x00000253B7FA0000-0x00000253B7FB0000-memory.dmp
memory/4748-148-0x00000253B6360000-0x00000253B6361000-memory.dmp
memory/4748-152-0x00000253B7FB0000-0x00000253B7FC0000-memory.dmp
memory/4748-153-0x00000253B8090000-0x00000253B80A0000-memory.dmp
memory/4748-156-0x00000253B7FC0000-0x00000253B7FD0000-memory.dmp
memory/4748-157-0x00000253B7FD0000-0x00000253B7FE0000-memory.dmp
memory/4748-158-0x00000253B7FE0000-0x00000253B7FF0000-memory.dmp
memory/4748-159-0x00000253B80A0000-0x00000253B80B0000-memory.dmp
memory/4748-165-0x00000253B80B0000-0x00000253B80C0000-memory.dmp
memory/4748-164-0x00000253B8010000-0x00000253B8020000-memory.dmp
memory/4748-163-0x00000253B8000000-0x00000253B8010000-memory.dmp
memory/4748-162-0x00000253B7FF0000-0x00000253B8000000-memory.dmp
memory/4748-168-0x00000253B8020000-0x00000253B8030000-memory.dmp
memory/4748-112-0x00000253B7FF0000-0x00000253B8000000-memory.dmp
memory/4748-119-0x00000253B6360000-0x00000253B6361000-memory.dmp
memory/4748-171-0x00000253B8030000-0x00000253B8040000-memory.dmp
memory/4748-177-0x00000253B6360000-0x00000253B6361000-memory.dmp
memory/4748-179-0x00000253B8040000-0x00000253B8050000-memory.dmp
memory/4748-182-0x00000253B6360000-0x00000253B6361000-memory.dmp
memory/4748-187-0x00000253B7E10000-0x00000253B7E20000-memory.dmp
memory/4748-17-0x00000253B7DE0000-0x00000253B7DF0000-memory.dmp
memory/4748-21-0x00000253B7E10000-0x00000253B7E20000-memory.dmp
memory/4748-18-0x00000253B7DF0000-0x00000253B7E00000-memory.dmp
memory/4748-19-0x00000253B7E00000-0x00000253B7E10000-memory.dmp
memory/4748-13-0x00000253B7DD0000-0x00000253B7DE0000-memory.dmp
memory/4748-2-0x00000253B7B60000-0x00000253B7DD0000-memory.dmp
memory/4748-186-0x00000253B7DF0000-0x00000253B7E00000-memory.dmp
memory/4748-185-0x00000253B7DE0000-0x00000253B7DF0000-memory.dmp
memory/4748-184-0x00000253B7DD0000-0x00000253B7DE0000-memory.dmp
memory/4748-183-0x00000253B7E00000-0x00000253B7E10000-memory.dmp