Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/06/2024, 09:51
General
- Target 85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar
- Size 448KB
- Sample240609-lvmxnahf87
- SHA256 85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
85af8304fde85bfbd5323012e0f79fab0045a85943454c7757dece03686b049f.jar
jna1674221490558307953.dll
83aa4cc77f591dfc2374580bbd95f6ba_310807ab-751f-4d81-ae09-b202eaf21e19
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/3448-100-0x0000029280380000-0x0000029280390000-memory.dmp
memory/3448-181-0x00000292804E0000-0x00000292804F0000-memory.dmp
memory/3448-22-0x00000292802B0000-0x00000292802C0000-memory.dmp
memory/3448-24-0x00000292802C0000-0x00000292802D0000-memory.dmp
memory/3448-28-0x00000292802E0000-0x00000292802F0000-memory.dmp
memory/3448-27-0x00000292802D0000-0x00000292802E0000-memory.dmp
memory/3448-30-0x00000292802F0000-0x0000029280300000-memory.dmp
memory/3448-32-0x0000029280300000-0x0000029280310000-memory.dmp
memory/3448-36-0x0000029280000000-0x0000029280270000-memory.dmp
memory/3448-38-0x0000029280320000-0x0000029280330000-memory.dmp
memory/3448-37-0x0000029280310000-0x0000029280320000-memory.dmp
memory/3448-44-0x0000029280350000-0x0000029280360000-memory.dmp
memory/3448-43-0x0000029280340000-0x0000029280350000-memory.dmp
memory/3448-48-0x0000029280360000-0x0000029280370000-memory.dmp
memory/3448-47-0x0000029280280000-0x0000029280290000-memory.dmp
memory/3448-51-0x0000029280370000-0x0000029280380000-memory.dmp
memory/3448-50-0x00000292802A0000-0x00000292802B0000-memory.dmp
memory/3448-53-0x00000292802B0000-0x00000292802C0000-memory.dmp
memory/3448-49-0x0000029280290000-0x00000292802A0000-memory.dmp
memory/3448-42-0x0000029280330000-0x0000029280340000-memory.dmp
memory/3448-41-0x0000029280270000-0x0000029280280000-memory.dmp
memory/3448-54-0x0000029280380000-0x0000029280390000-memory.dmp
memory/3448-62-0x00000292802D0000-0x00000292802E0000-memory.dmp
memory/3448-63-0x0000029280390000-0x00000292803A0000-memory.dmp
memory/3448-61-0x00000292802C0000-0x00000292802D0000-memory.dmp
memory/3448-64-0x00000292803A0000-0x00000292803B0000-memory.dmp
memory/3448-68-0x00000292803B0000-0x00000292803C0000-memory.dmp
memory/3448-69-0x00000292803C0000-0x00000292803D0000-memory.dmp
memory/3448-67-0x00000292802E0000-0x00000292802F0000-memory.dmp
memory/3448-71-0x00000292F2350000-0x00000292F2351000-memory.dmp
memory/3448-73-0x00000292803D0000-0x00000292803E0000-memory.dmp
memory/3448-72-0x00000292802F0000-0x0000029280300000-memory.dmp
memory/3448-78-0x0000029280310000-0x0000029280320000-memory.dmp
memory/3448-80-0x00000292803F0000-0x0000029280400000-memory.dmp
memory/3448-79-0x0000029280320000-0x0000029280330000-memory.dmp
memory/3448-85-0x0000029280400000-0x0000029280410000-memory.dmp
memory/3448-84-0x0000029280350000-0x0000029280360000-memory.dmp
memory/3448-83-0x0000029280340000-0x0000029280350000-memory.dmp
memory/3448-82-0x0000029280330000-0x0000029280340000-memory.dmp
memory/3448-76-0x0000029280300000-0x0000029280310000-memory.dmp
memory/3448-77-0x00000292803E0000-0x00000292803F0000-memory.dmp
memory/3448-120-0x00000292803C0000-0x00000292803D0000-memory.dmp
memory/3448-88-0x0000029280360000-0x0000029280370000-memory.dmp
memory/3448-89-0x0000029280410000-0x0000029280420000-memory.dmp
memory/3448-94-0x0000029280370000-0x0000029280380000-memory.dmp
memory/3448-95-0x0000029280430000-0x0000029280440000-memory.dmp
memory/3448-101-0x0000029280440000-0x0000029280450000-memory.dmp
memory/3448-20-0x00000292802A0000-0x00000292802B0000-memory.dmp
memory/3448-114-0x00000292803A0000-0x00000292803B0000-memory.dmp
memory/3448-118-0x00000292804B0000-0x00000292804C0000-memory.dmp
memory/3448-117-0x00000292804A0000-0x00000292804B0000-memory.dmp
memory/3448-116-0x0000029280490000-0x00000292804A0000-memory.dmp
memory/3448-19-0x0000029280290000-0x00000292802A0000-memory.dmp
memory/3448-121-0x00000292804C0000-0x00000292804D0000-memory.dmp
memory/3448-90-0x0000029280420000-0x0000029280430000-memory.dmp
memory/3448-119-0x00000292803B0000-0x00000292803C0000-memory.dmp
memory/3448-115-0x0000029280480000-0x0000029280490000-memory.dmp
memory/3448-109-0x0000029280470000-0x0000029280480000-memory.dmp
memory/3448-107-0x0000029280460000-0x0000029280470000-memory.dmp
memory/3448-106-0x0000029280450000-0x0000029280460000-memory.dmp
memory/3448-105-0x0000029280390000-0x00000292803A0000-memory.dmp
memory/3448-127-0x00000292F2350000-0x00000292F2351000-memory.dmp
memory/3448-132-0x00000292803E0000-0x00000292803F0000-memory.dmp
memory/3448-136-0x00000292803F0000-0x0000029280400000-memory.dmp
memory/3448-135-0x00000292804F0000-0x0000029280500000-memory.dmp
memory/3448-134-0x00000292804E0000-0x00000292804F0000-memory.dmp
memory/3448-133-0x00000292804D0000-0x00000292804E0000-memory.dmp
memory/3448-131-0x00000292803D0000-0x00000292803E0000-memory.dmp
memory/3448-138-0x0000029280500000-0x0000029280510000-memory.dmp
memory/3448-140-0x0000029280400000-0x0000029280410000-memory.dmp
memory/3448-141-0x0000029280510000-0x0000029280520000-memory.dmp
memory/3448-148-0x0000029280530000-0x0000029280540000-memory.dmp
memory/3448-147-0x0000029280430000-0x0000029280440000-memory.dmp
memory/3448-146-0x0000029280520000-0x0000029280530000-memory.dmp
memory/3448-145-0x0000029280420000-0x0000029280430000-memory.dmp
memory/3448-144-0x0000029280410000-0x0000029280420000-memory.dmp
memory/3448-151-0x0000029280440000-0x0000029280450000-memory.dmp
memory/3448-152-0x0000029280540000-0x0000029280550000-memory.dmp
memory/3448-154-0x0000029280450000-0x0000029280460000-memory.dmp
memory/3448-156-0x0000029280470000-0x0000029280480000-memory.dmp
memory/3448-157-0x0000029280550000-0x0000029280560000-memory.dmp
memory/3448-155-0x0000029280460000-0x0000029280470000-memory.dmp
memory/3448-158-0x00000292F2350000-0x00000292F2351000-memory.dmp
memory/3448-167-0x0000029280560000-0x0000029280570000-memory.dmp
memory/3448-166-0x00000292804B0000-0x00000292804C0000-memory.dmp
memory/3448-165-0x00000292804A0000-0x00000292804B0000-memory.dmp
memory/3448-164-0x0000029280490000-0x00000292804A0000-memory.dmp
memory/3448-163-0x0000029280480000-0x0000029280490000-memory.dmp
memory/3448-175-0x00000292F2350000-0x00000292F2351000-memory.dmp
memory/3448-177-0x00000292804C0000-0x00000292804D0000-memory.dmp
memory/3448-183-0x0000029280580000-0x0000029280590000-memory.dmp
memory/3448-182-0x0000029280570000-0x0000029280580000-memory.dmp
memory/3448-184-0x00000292F2350000-0x00000292F2351000-memory.dmp
memory/3448-124-0x00000292F2350000-0x00000292F2351000-memory.dmp
memory/3448-180-0x00000292804D0000-0x00000292804E0000-memory.dmp
memory/3448-16-0x0000029280280000-0x0000029280290000-memory.dmp
memory/3448-185-0x0000029280000000-0x0000029280270000-memory.dmp
memory/3448-187-0x0000029280280000-0x0000029280290000-memory.dmp
memory/3448-188-0x0000029280290000-0x00000292802A0000-memory.dmp
memory/3448-186-0x0000029280270000-0x0000029280280000-memory.dmp
memory/3448-2-0x0000029280000000-0x0000029280270000-memory.dmp
memory/3448-14-0x0000029280270000-0x0000029280280000-memory.dmp
memory/3448-12-0x00000292F2350000-0x00000292F2351000-memory.dmp
memory/4472-242-0x0000027593DE0000-0x0000027593DE1000-memory.dmp
memory/4480-367-0x0000016EDE6C0000-0x0000016EDE6C1000-memory.dmp