Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
16/06/2024, 01:19
General
- Target 97c277a6f9429d969d7948cf9fdf988007f4fe1a5e8743705b7fcafe8536ecdc.jar
- Size 559KB
- Sample240616-bprzbatbnc
- SHA256 97c277a6f9429d969d7948cf9fdf988007f4fe1a5e8743705b7fcafe8536ecdc
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\97c277a6f9429d969d7948cf9fdf988007f4fe1a5e8743705b7fcafe8536ecdc.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\97c277a6f9429d969d7948cf9fdf988007f4fe1a5e8743705b7fcafe8536ecdc.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\97c277a6f9429d969d7948cf9fdf988007f4fe1a5e8743705b7fcafe8536ecdc.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\97c277a6f9429d969d7948cf9fdf988007f4fe1a5e8743705b7fcafe8536ecdc.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\97c277a6f9429d969d7948cf9fdf988007f4fe1a5e8743705b7fcafe8536ecdc.jar"3⤵
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3580,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
97c277a6f9429d969d7948cf9fdf988007f4fe1a5e8743705b7fcafe8536ecdc.jar
jna76028171790968229.dll
83aa4cc77f591dfc2374580bbd95f6ba_0c2dbd8b-df2c-459b-9e3f-15002e1e55b7
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1236-237-0x000001D406CE0000-0x000001D406CE1000-memory.dmp
memory/3112-288-0x0000025EEDF70000-0x0000025EEDF71000-memory.dmp
memory/3192-104-0x00000268A6550000-0x00000268A6551000-memory.dmp
memory/3192-61-0x00000268A7FE0000-0x00000268A7FF0000-memory.dmp
memory/3192-29-0x00000268A8010000-0x00000268A8020000-memory.dmp
memory/3192-28-0x00000268A8000000-0x00000268A8010000-memory.dmp
memory/3192-33-0x00000268A8020000-0x00000268A8030000-memory.dmp
memory/3192-31-0x00000268A6550000-0x00000268A6551000-memory.dmp
memory/3192-34-0x00000268A8030000-0x00000268A8040000-memory.dmp
memory/3192-41-0x00000268A8040000-0x00000268A8050000-memory.dmp
memory/3192-46-0x00000268A8050000-0x00000268A8060000-memory.dmp
memory/3192-53-0x00000268A7FC0000-0x00000268A7FD0000-memory.dmp
memory/3192-52-0x00000268A8080000-0x00000268A8090000-memory.dmp
memory/3192-51-0x00000268A7FB0000-0x00000268A7FC0000-memory.dmp
memory/3192-50-0x00000268A7FA0000-0x00000268A7FB0000-memory.dmp
memory/3192-48-0x00000268A8070000-0x00000268A8080000-memory.dmp
memory/3192-47-0x00000268A8060000-0x00000268A8070000-memory.dmp
memory/3192-44-0x00000268A7D20000-0x00000268A7F90000-memory.dmp
memory/3192-49-0x00000268A7F90000-0x00000268A7FA0000-memory.dmp
memory/3192-59-0x00000268A80A0000-0x00000268A80B0000-memory.dmp
memory/3192-57-0x00000268A8090000-0x00000268A80A0000-memory.dmp
memory/3192-56-0x00000268A7FD0000-0x00000268A7FE0000-memory.dmp
memory/3192-62-0x00000268A80B0000-0x00000268A80C0000-memory.dmp
memory/3192-111-0x00000268A8090000-0x00000268A80A0000-memory.dmp
memory/3192-64-0x00000268A80C0000-0x00000268A80D0000-memory.dmp
memory/3192-63-0x00000268A7FF0000-0x00000268A8000000-memory.dmp
memory/3192-70-0x00000268A80D0000-0x00000268A80E0000-memory.dmp
memory/3192-115-0x00000268A80B0000-0x00000268A80C0000-memory.dmp
memory/3192-69-0x00000268A8010000-0x00000268A8020000-memory.dmp
memory/3192-71-0x00000268A6550000-0x00000268A6551000-memory.dmp
memory/3192-73-0x00000268A6550000-0x00000268A6551000-memory.dmp
memory/3192-74-0x00000268A8020000-0x00000268A8030000-memory.dmp
memory/3192-75-0x00000268A80E0000-0x00000268A80F0000-memory.dmp
memory/3192-82-0x00000268A8100000-0x00000268A8110000-memory.dmp
memory/3192-81-0x00000268A80F0000-0x00000268A8100000-memory.dmp
memory/3192-80-0x00000268A8030000-0x00000268A8040000-memory.dmp
memory/3192-91-0x00000268A8110000-0x00000268A8120000-memory.dmp
memory/3192-88-0x00000268A8040000-0x00000268A8050000-memory.dmp
memory/3192-100-0x00000268A8170000-0x00000268A8180000-memory.dmp
memory/3192-99-0x00000268A8070000-0x00000268A8080000-memory.dmp
memory/3192-98-0x00000268A8160000-0x00000268A8170000-memory.dmp
memory/3192-97-0x00000268A8060000-0x00000268A8070000-memory.dmp
memory/3192-112-0x00000268A80A0000-0x00000268A80B0000-memory.dmp
memory/3192-95-0x00000268A8150000-0x00000268A8160000-memory.dmp
memory/3192-94-0x00000268A8140000-0x00000268A8150000-memory.dmp
memory/3192-93-0x00000268A8130000-0x00000268A8140000-memory.dmp
memory/3192-92-0x00000268A8120000-0x00000268A8130000-memory.dmp
memory/3192-23-0x00000268A7FE0000-0x00000268A7FF0000-memory.dmp
memory/3192-107-0x00000268A6550000-0x00000268A6551000-memory.dmp
memory/3192-109-0x00000268A8180000-0x00000268A8190000-memory.dmp
memory/3192-108-0x00000268A8080000-0x00000268A8090000-memory.dmp
memory/3192-113-0x00000268A8190000-0x00000268A81A0000-memory.dmp
memory/3192-96-0x00000268A8050000-0x00000268A8060000-memory.dmp
memory/3192-26-0x00000268A7FF0000-0x00000268A8000000-memory.dmp
memory/3192-68-0x00000268A8000000-0x00000268A8010000-memory.dmp
memory/3192-116-0x00000268A81A0000-0x00000268A81B0000-memory.dmp
memory/3192-119-0x00000268A81B0000-0x00000268A81C0000-memory.dmp
memory/3192-118-0x00000268A80C0000-0x00000268A80D0000-memory.dmp
memory/3192-121-0x00000268A80D0000-0x00000268A80E0000-memory.dmp
memory/3192-122-0x00000268A81C0000-0x00000268A81D0000-memory.dmp
memory/3192-127-0x00000268A81E0000-0x00000268A81F0000-memory.dmp
memory/3192-126-0x00000268A81D0000-0x00000268A81E0000-memory.dmp
memory/3192-125-0x00000268A80E0000-0x00000268A80F0000-memory.dmp
memory/3192-133-0x00000268A80F0000-0x00000268A8100000-memory.dmp
memory/3192-139-0x00000268A8200000-0x00000268A8210000-memory.dmp
memory/3192-138-0x00000268A81F0000-0x00000268A8200000-memory.dmp
memory/3192-137-0x00000268A8110000-0x00000268A8120000-memory.dmp
memory/3192-136-0x00000268A8100000-0x00000268A8110000-memory.dmp
memory/3192-131-0x00000268A6550000-0x00000268A6551000-memory.dmp
memory/3192-145-0x00000268A8210000-0x00000268A8220000-memory.dmp
memory/3192-142-0x00000268A8130000-0x00000268A8140000-memory.dmp
memory/3192-144-0x00000268A8150000-0x00000268A8160000-memory.dmp
memory/3192-143-0x00000268A8140000-0x00000268A8150000-memory.dmp
memory/3192-141-0x00000268A8120000-0x00000268A8130000-memory.dmp
memory/3192-153-0x00000268A6550000-0x00000268A6551000-memory.dmp
memory/3192-155-0x00000268A8160000-0x00000268A8170000-memory.dmp
memory/3192-157-0x00000268A8170000-0x00000268A8180000-memory.dmp
memory/3192-158-0x00000268A8220000-0x00000268A8230000-memory.dmp
memory/3192-159-0x00000268A6550000-0x00000268A6551000-memory.dmp
memory/3192-168-0x00000268A8000000-0x00000268A8010000-memory.dmp
memory/3192-170-0x00000268A8020000-0x00000268A8030000-memory.dmp
memory/3192-180-0x00000268A8190000-0x00000268A81A0000-memory.dmp
memory/3192-179-0x00000268A8180000-0x00000268A8190000-memory.dmp
memory/3192-178-0x00000268A8050000-0x00000268A8060000-memory.dmp
memory/3192-177-0x00000268A80E0000-0x00000268A80F0000-memory.dmp
memory/3192-176-0x00000268A80D0000-0x00000268A80E0000-memory.dmp
memory/3192-175-0x00000268A7FA0000-0x00000268A7FB0000-memory.dmp
memory/3192-174-0x00000268A7D20000-0x00000268A7F90000-memory.dmp
memory/3192-173-0x00000268A8060000-0x00000268A8070000-memory.dmp
memory/3192-172-0x00000268A8040000-0x00000268A8050000-memory.dmp
memory/3192-171-0x00000268A8030000-0x00000268A8040000-memory.dmp
memory/3192-169-0x00000268A8010000-0x00000268A8020000-memory.dmp
memory/3192-161-0x00000268A7F90000-0x00000268A7FA0000-memory.dmp
memory/3192-167-0x00000268A7FF0000-0x00000268A8000000-memory.dmp
memory/3192-166-0x00000268A7FE0000-0x00000268A7FF0000-memory.dmp
memory/3192-165-0x00000268A7FD0000-0x00000268A7FE0000-memory.dmp
memory/3192-21-0x00000268A7FD0000-0x00000268A7FE0000-memory.dmp
memory/3192-20-0x00000268A7FC0000-0x00000268A7FD0000-memory.dmp
memory/3192-15-0x00000268A7F90000-0x00000268A7FA0000-memory.dmp
memory/3192-16-0x00000268A7FA0000-0x00000268A7FB0000-memory.dmp
memory/3192-17-0x00000268A7FB0000-0x00000268A7FC0000-memory.dmp
memory/3192-2-0x00000268A7D20000-0x00000268A7F90000-memory.dmp
memory/3192-164-0x00000268A7FC0000-0x00000268A7FD0000-memory.dmp
memory/3192-163-0x00000268A7FB0000-0x00000268A7FC0000-memory.dmp
memory/3192-162-0x00000268A8080000-0x00000268A8090000-memory.dmp
memory/3192-160-0x00000268A8070000-0x00000268A8080000-memory.dmp