Resubmissions
13/06/2024, 23:11
240613-26phmaybpj713/06/2024, 23:10
240613-253c4avbqd713/06/2024, 23:10
240613-25stnayblk7Analysis
- max time kernel
148s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 23:11
General
- Target meteor-client-0.5.6.jar
- Size 4.3MB
- Sample240613-26phmaybpj
- SHA256 0058cfe2b24392bb6d84a7cbae10c66ecadfcef47b31e7fa5ad0e8f0b4f71c99
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\meteor-client-0.5.6.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/4060-2-0x000002182D9C0000-0x000002182DC30000-memory.dmp
memory/4060-18-0x000002182C1F0000-0x000002182C1F1000-memory.dmp
memory/4060-24-0x000002182DC30000-0x000002182DC40000-memory.dmp
memory/4060-27-0x000002182DC40000-0x000002182DC50000-memory.dmp
memory/4060-30-0x000002182DC50000-0x000002182DC60000-memory.dmp
memory/4060-32-0x000002182DC60000-0x000002182DC70000-memory.dmp
memory/4060-34-0x000002182DC70000-0x000002182DC80000-memory.dmp
memory/4060-36-0x000002182DC80000-0x000002182DC90000-memory.dmp
memory/4060-40-0x000002182DC90000-0x000002182DCA0000-memory.dmp
memory/4060-43-0x000002182D9C0000-0x000002182DC30000-memory.dmp
memory/4060-44-0x000002182DCA0000-0x000002182DCB0000-memory.dmp
memory/4060-46-0x000002182DCB0000-0x000002182DCC0000-memory.dmp
memory/4060-49-0x000002182DCC0000-0x000002182DCD0000-memory.dmp
memory/4060-52-0x000002182DC30000-0x000002182DC40000-memory.dmp
memory/4060-53-0x000002182DCD0000-0x000002182DCE0000-memory.dmp
memory/4060-57-0x000002182DCE0000-0x000002182DCF0000-memory.dmp
memory/4060-56-0x000002182DC40000-0x000002182DC50000-memory.dmp
memory/4060-59-0x000002182DC50000-0x000002182DC60000-memory.dmp
memory/4060-60-0x000002182DCF0000-0x000002182DD00000-memory.dmp
memory/4060-62-0x000002182DC60000-0x000002182DC70000-memory.dmp
memory/4060-63-0x000002182DD00000-0x000002182DD10000-memory.dmp
memory/4060-66-0x000002182DC70000-0x000002182DC80000-memory.dmp
memory/4060-67-0x000002182DD10000-0x000002182DD20000-memory.dmp
memory/4060-72-0x000002182DC80000-0x000002182DC90000-memory.dmp
memory/4060-74-0x000002182DD20000-0x000002182DD30000-memory.dmp
memory/4060-73-0x000002182DC90000-0x000002182DCA0000-memory.dmp
memory/4060-76-0x000002182DCA0000-0x000002182DCB0000-memory.dmp
memory/4060-77-0x000002182DD30000-0x000002182DD40000-memory.dmp
memory/4060-79-0x000002182DCB0000-0x000002182DCC0000-memory.dmp
memory/4060-80-0x000002182DD40000-0x000002182DD50000-memory.dmp
memory/4060-82-0x000002182DCC0000-0x000002182DCD0000-memory.dmp
memory/4060-83-0x000002182DD50000-0x000002182DD60000-memory.dmp
memory/4060-85-0x000002182DCD0000-0x000002182DCE0000-memory.dmp
memory/4060-86-0x000002182DD60000-0x000002182DD70000-memory.dmp
memory/4060-90-0x000002182DCE0000-0x000002182DCF0000-memory.dmp
memory/4060-92-0x000002182DCF0000-0x000002182DD00000-memory.dmp
memory/4060-93-0x000002182DD00000-0x000002182DD10000-memory.dmp
memory/4060-94-0x000002182DD70000-0x000002182DD80000-memory.dmp
memory/4060-97-0x000002182DD10000-0x000002182DD20000-memory.dmp
memory/4060-98-0x000002182DD80000-0x000002182DD90000-memory.dmp
memory/4060-100-0x000002182DD90000-0x000002182DDA0000-memory.dmp
memory/4060-103-0x000002182DD20000-0x000002182DD30000-memory.dmp
memory/4060-106-0x000002182DDA0000-0x000002182DDB0000-memory.dmp
memory/4060-105-0x000002182DD30000-0x000002182DD40000-memory.dmp
memory/4060-109-0x000002182DD40000-0x000002182DD50000-memory.dmp
memory/4060-110-0x000002182DD50000-0x000002182DD60000-memory.dmp
memory/4060-111-0x000002182DD60000-0x000002182DD70000-memory.dmp
memory/4060-116-0x000002182DD70000-0x000002182DD80000-memory.dmp
memory/4060-118-0x000002182DD80000-0x000002182DD90000-memory.dmp
memory/4060-119-0x000002182DD90000-0x000002182DDA0000-memory.dmp
memory/4060-121-0x000002182DDA0000-0x000002182DDB0000-memory.dmp
memory/4060-122-0x000002182DDB0000-0x000002182DDC0000-memory.dmp
memory/4060-131-0x000002182DDB0000-0x000002182DDC0000-memory.dmp
memory/4060-137-0x000002182DDC0000-0x000002182DDD0000-memory.dmp
memory/4060-142-0x000002182DDE0000-0x000002182DDF0000-memory.dmp
memory/4060-144-0x000002182DDC0000-0x000002182DDD0000-memory.dmp
memory/4060-147-0x000002182DDD0000-0x000002182DDE0000-memory.dmp
memory/4060-149-0x000002182DDE0000-0x000002182DDF0000-memory.dmp
memory/4060-150-0x000002182DDF0000-0x000002182DE00000-memory.dmp
memory/4060-153-0x000002182DE00000-0x000002182DE10000-memory.dmp
memory/4060-158-0x000002182DDD0000-0x000002182DDE0000-memory.dmp
memory/4060-160-0x000002182DE10000-0x000002182DE20000-memory.dmp
memory/4060-163-0x000002182DDF0000-0x000002182DE00000-memory.dmp
memory/4060-166-0x000002182DE00000-0x000002182DE10000-memory.dmp