Resubmissions
13/06/2024, 23:11
240613-26phmaybpj713/06/2024, 23:10
240613-253c4avbqd713/06/2024, 23:10
240613-25stnayblk7Analysis
- max time kernel
300s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 23:10
General
- Target meteor-client-0.5.6.jar
- Size 4.3MB
- Sample240613-253c4avbqd
- SHA256 0058cfe2b24392bb6d84a7cbae10c66ecadfcef47b31e7fa5ad0e8f0b4f71c99
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\meteor-client-0.5.6.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/5084-2-0x0000028A700D0000-0x0000028A70340000-memory.dmp
memory/5084-18-0x0000028A700B0000-0x0000028A700B1000-memory.dmp
memory/5084-24-0x0000028A70340000-0x0000028A70350000-memory.dmp
memory/5084-27-0x0000028A70350000-0x0000028A70360000-memory.dmp
memory/5084-30-0x0000028A70360000-0x0000028A70370000-memory.dmp
memory/5084-32-0x0000028A70370000-0x0000028A70380000-memory.dmp
memory/5084-34-0x0000028A70380000-0x0000028A70390000-memory.dmp
memory/5084-36-0x0000028A70390000-0x0000028A703A0000-memory.dmp
memory/5084-40-0x0000028A703A0000-0x0000028A703B0000-memory.dmp
memory/5084-43-0x0000028A700D0000-0x0000028A70340000-memory.dmp
memory/5084-44-0x0000028A703B0000-0x0000028A703C0000-memory.dmp
memory/5084-46-0x0000028A703C0000-0x0000028A703D0000-memory.dmp
memory/5084-50-0x0000028A703D0000-0x0000028A703E0000-memory.dmp
memory/5084-53-0x0000028A703E0000-0x0000028A703F0000-memory.dmp
memory/5084-52-0x0000028A70340000-0x0000028A70350000-memory.dmp
memory/5084-56-0x0000028A70350000-0x0000028A70360000-memory.dmp
memory/5084-57-0x0000028A703F0000-0x0000028A70400000-memory.dmp
memory/5084-59-0x0000028A70360000-0x0000028A70370000-memory.dmp
memory/5084-60-0x0000028A70400000-0x0000028A70410000-memory.dmp
memory/5084-62-0x0000028A70370000-0x0000028A70380000-memory.dmp
memory/5084-63-0x0000028A70410000-0x0000028A70420000-memory.dmp
memory/5084-67-0x0000028A70380000-0x0000028A70390000-memory.dmp
memory/5084-68-0x0000028A70420000-0x0000028A70430000-memory.dmp
memory/5084-73-0x0000028A70390000-0x0000028A703A0000-memory.dmp
memory/5084-74-0x0000028A703A0000-0x0000028A703B0000-memory.dmp
memory/5084-75-0x0000028A70430000-0x0000028A70440000-memory.dmp
memory/5084-77-0x0000028A703B0000-0x0000028A703C0000-memory.dmp
memory/5084-78-0x0000028A70440000-0x0000028A70450000-memory.dmp
memory/5084-81-0x0000028A703C0000-0x0000028A703D0000-memory.dmp
memory/5084-82-0x0000028A70450000-0x0000028A70460000-memory.dmp
memory/5084-85-0x0000028A703D0000-0x0000028A703E0000-memory.dmp
memory/5084-86-0x0000028A70460000-0x0000028A70470000-memory.dmp
memory/5084-88-0x0000028A703E0000-0x0000028A703F0000-memory.dmp
memory/5084-90-0x0000028A703F0000-0x0000028A70400000-memory.dmp
memory/5084-91-0x0000028A70470000-0x0000028A70480000-memory.dmp
memory/5084-93-0x0000028A70400000-0x0000028A70410000-memory.dmp
memory/5084-97-0x0000028A70410000-0x0000028A70420000-memory.dmp
memory/5084-98-0x0000028A70480000-0x0000028A70490000-memory.dmp
memory/5084-100-0x0000028A70490000-0x0000028A704A0000-memory.dmp
memory/5084-99-0x0000028A70420000-0x0000028A70430000-memory.dmp
memory/5084-102-0x0000028A704A0000-0x0000028A704B0000-memory.dmp
memory/5084-105-0x0000028A70430000-0x0000028A70440000-memory.dmp
memory/5084-106-0x0000028A70440000-0x0000028A70450000-memory.dmp
memory/5084-109-0x0000028A70450000-0x0000028A70460000-memory.dmp
memory/5084-111-0x0000028A70460000-0x0000028A70470000-memory.dmp
memory/5084-113-0x0000028A70470000-0x0000028A70480000-memory.dmp
memory/5084-114-0x0000028A704B0000-0x0000028A704C0000-memory.dmp
memory/5084-116-0x0000028A70480000-0x0000028A70490000-memory.dmp
memory/5084-118-0x0000028A70490000-0x0000028A704A0000-memory.dmp
memory/5084-120-0x0000028A704A0000-0x0000028A704B0000-memory.dmp
memory/5084-126-0x0000028A704B0000-0x0000028A704C0000-memory.dmp
memory/5084-132-0x0000028A704C0000-0x0000028A704D0000-memory.dmp
memory/5084-138-0x0000028A704D0000-0x0000028A704E0000-memory.dmp
memory/5084-141-0x0000028A704C0000-0x0000028A704D0000-memory.dmp
memory/5084-145-0x0000028A704D0000-0x0000028A704E0000-memory.dmp
memory/5084-147-0x0000028A704E0000-0x0000028A704F0000-memory.dmp
memory/5084-150-0x0000028A704F0000-0x0000028A70500000-memory.dmp
memory/5084-152-0x0000028A70500000-0x0000028A70510000-memory.dmp
memory/5084-154-0x0000028A70510000-0x0000028A70520000-memory.dmp
memory/5084-157-0x0000028A704E0000-0x0000028A704F0000-memory.dmp
memory/5084-160-0x0000028A70520000-0x0000028A70530000-memory.dmp
memory/5084-164-0x0000028A704F0000-0x0000028A70500000-memory.dmp
memory/5084-165-0x0000028A70500000-0x0000028A70510000-memory.dmp
memory/5084-166-0x0000028A70510000-0x0000028A70520000-memory.dmp
memory/5084-170-0x0000028A70520000-0x0000028A70530000-memory.dmp
memory/5084-173-0x0000028A70530000-0x0000028A70540000-memory.dmp
memory/5084-178-0x0000028A70540000-0x0000028A70550000-memory.dmp
memory/5084-181-0x0000028A70550000-0x0000028A70560000-memory.dmp
memory/5084-185-0x0000028A70560000-0x0000028A70570000-memory.dmp
memory/5084-186-0x0000028A70570000-0x0000028A70580000-memory.dmp
memory/5084-189-0x0000028A70540000-0x0000028A70550000-memory.dmp
memory/5084-190-0x0000028A70550000-0x0000028A70560000-memory.dmp
memory/5084-191-0x0000028A70560000-0x0000028A70570000-memory.dmp
memory/5084-192-0x0000028A70570000-0x0000028A70580000-memory.dmp