Analysis
- max time kernel
27s - max time network
40s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
06/07/2024, 15:33
General
- Target 3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar
- Size 203KB
- Sample240706-szpelsshmm
- SHA256 3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b
Malware Config
Extracted
-
strrat
-
dollarman101.hopto.org:6060
-
license_id
ZTT1-7ZAL-XCZM-48JG-C0LB
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar
83aa4cc77f591dfc2374580bbd95f6ba_f4fe33a0-f73d-4d5c-8730-deeef20ef238
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
jna4089755132042383102.dll
memory/428-124-0x0000011506990000-0x00000115069A0000-memory.dmp
memory/428-201-0x0000011506870000-0x0000011506880000-memory.dmp
memory/428-23-0x0000011506830000-0x0000011506840000-memory.dmp
memory/428-25-0x0000011506840000-0x0000011506850000-memory.dmp
memory/428-32-0x0000011506850000-0x0000011506860000-memory.dmp
memory/428-34-0x0000011506860000-0x0000011506870000-memory.dmp
memory/428-36-0x0000011506870000-0x0000011506880000-memory.dmp
memory/428-38-0x0000011506580000-0x00000115067F0000-memory.dmp
memory/428-39-0x0000011506880000-0x0000011506890000-memory.dmp
memory/428-42-0x00000115067F0000-0x0000011506800000-memory.dmp
memory/428-45-0x0000011506800000-0x0000011506810000-memory.dmp
memory/428-46-0x00000115068A0000-0x00000115068B0000-memory.dmp
memory/428-43-0x0000011506890000-0x00000115068A0000-memory.dmp
memory/428-48-0x0000011506810000-0x0000011506820000-memory.dmp
memory/428-51-0x00000115068C0000-0x00000115068D0000-memory.dmp
memory/428-50-0x0000011506820000-0x0000011506830000-memory.dmp
memory/428-49-0x00000115068B0000-0x00000115068C0000-memory.dmp
memory/428-52-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-56-0x00000115068D0000-0x00000115068E0000-memory.dmp
memory/428-55-0x0000011506830000-0x0000011506840000-memory.dmp
memory/428-59-0x0000011506840000-0x0000011506850000-memory.dmp
memory/428-60-0x00000115068E0000-0x00000115068F0000-memory.dmp
memory/428-62-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-64-0x0000011506850000-0x0000011506860000-memory.dmp
memory/428-65-0x00000115068F0000-0x0000011506900000-memory.dmp
memory/428-70-0x0000011506900000-0x0000011506910000-memory.dmp
memory/428-69-0x0000011506860000-0x0000011506870000-memory.dmp
memory/428-76-0x0000011506880000-0x0000011506890000-memory.dmp
memory/428-74-0x0000011506910000-0x0000011506920000-memory.dmp
memory/428-75-0x0000011506920000-0x0000011506930000-memory.dmp
memory/428-73-0x0000011506870000-0x0000011506880000-memory.dmp
memory/428-79-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-80-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-85-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-88-0x0000011506890000-0x00000115068A0000-memory.dmp
memory/428-89-0x0000011506930000-0x0000011506940000-memory.dmp
memory/428-98-0x0000011506940000-0x0000011506950000-memory.dmp
memory/428-97-0x00000115068B0000-0x00000115068C0000-memory.dmp
memory/428-96-0x00000115068A0000-0x00000115068B0000-memory.dmp
memory/428-100-0x0000011506950000-0x0000011506960000-memory.dmp
memory/428-101-0x00000115068C0000-0x00000115068D0000-memory.dmp
memory/428-102-0x0000011506960000-0x0000011506970000-memory.dmp
memory/428-107-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-109-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-108-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-113-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-116-0x0000011506970000-0x0000011506980000-memory.dmp
memory/428-115-0x00000115068D0000-0x00000115068E0000-memory.dmp
memory/428-118-0x00000115068E0000-0x00000115068F0000-memory.dmp
memory/428-119-0x0000011506980000-0x0000011506990000-memory.dmp
memory/428-121-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-126-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-125-0x00000115069A0000-0x00000115069B0000-memory.dmp
memory/428-19-0x0000011506810000-0x0000011506820000-memory.dmp
memory/428-123-0x00000115068F0000-0x0000011506900000-memory.dmp
memory/428-129-0x00000115069B0000-0x00000115069C0000-memory.dmp
memory/428-22-0x0000011506820000-0x0000011506830000-memory.dmp
memory/428-128-0x0000011506900000-0x0000011506910000-memory.dmp
memory/428-17-0x0000011506800000-0x0000011506810000-memory.dmp
memory/428-137-0x0000011506910000-0x0000011506920000-memory.dmp
memory/428-142-0x00000115069D0000-0x00000115069E0000-memory.dmp
memory/428-141-0x0000011506920000-0x0000011506930000-memory.dmp
memory/428-145-0x00000115069E0000-0x00000115069F0000-memory.dmp
memory/428-144-0x0000011506930000-0x0000011506940000-memory.dmp
memory/428-150-0x0000011506940000-0x0000011506950000-memory.dmp
memory/428-151-0x0000011506950000-0x0000011506960000-memory.dmp
memory/428-152-0x00000115069F0000-0x0000011506A00000-memory.dmp
memory/428-155-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-158-0x0000011506960000-0x0000011506970000-memory.dmp
memory/428-162-0x0000011506970000-0x0000011506980000-memory.dmp
memory/428-173-0x0000011506980000-0x0000011506990000-memory.dmp
memory/428-176-0x0000011506990000-0x00000115069A0000-memory.dmp
memory/428-178-0x0000011506A00000-0x0000011506A10000-memory.dmp
memory/428-177-0x00000115069A0000-0x00000115069B0000-memory.dmp
memory/428-175-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-186-0x0000011506820000-0x0000011506830000-memory.dmp
memory/428-131-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-208-0x0000011506970000-0x0000011506980000-memory.dmp
memory/428-207-0x00000115069F0000-0x0000011506A00000-memory.dmp
memory/428-206-0x00000115069E0000-0x00000115069F0000-memory.dmp
memory/428-205-0x00000115069D0000-0x00000115069E0000-memory.dmp
memory/428-204-0x00000115069C0000-0x00000115069D0000-memory.dmp
memory/428-200-0x0000011506910000-0x0000011506920000-memory.dmp
memory/428-199-0x0000011506900000-0x0000011506910000-memory.dmp
memory/428-198-0x00000115068F0000-0x0000011506900000-memory.dmp
memory/428-197-0x00000115068E0000-0x00000115068F0000-memory.dmp
memory/428-196-0x00000115068D0000-0x00000115068E0000-memory.dmp
memory/428-194-0x00000115068C0000-0x00000115068D0000-memory.dmp
memory/428-203-0x00000115069B0000-0x00000115069C0000-memory.dmp
memory/428-191-0x0000011506880000-0x0000011506890000-memory.dmp
memory/428-190-0x0000011506860000-0x0000011506870000-memory.dmp
memory/428-189-0x0000011506850000-0x0000011506860000-memory.dmp
memory/428-188-0x0000011506840000-0x0000011506850000-memory.dmp
memory/428-187-0x0000011506830000-0x0000011506840000-memory.dmp
memory/428-185-0x0000011506810000-0x0000011506820000-memory.dmp
memory/428-184-0x0000011506800000-0x0000011506810000-memory.dmp
memory/428-183-0x00000115067F0000-0x0000011506800000-memory.dmp
memory/428-182-0x0000011506580000-0x00000115067F0000-memory.dmp
memory/428-195-0x00000115068B0000-0x00000115068C0000-memory.dmp
memory/428-138-0x00000115069C0000-0x00000115069D0000-memory.dmp
memory/428-15-0x00000115067F0000-0x0000011506800000-memory.dmp
memory/428-193-0x00000115068A0000-0x00000115068B0000-memory.dmp
memory/428-192-0x0000011506890000-0x00000115068A0000-memory.dmp
memory/428-2-0x0000011506580000-0x00000115067F0000-memory.dmp
memory/428-12-0x0000011506560000-0x0000011506561000-memory.dmp
memory/428-13-0x0000011506560000-0x0000011506561000-memory.dmp
memory/484-226-0x0000019668340000-0x0000019668350000-memory.dmp
memory/484-230-0x0000019668360000-0x0000019668370000-memory.dmp
memory/484-229-0x0000019668350000-0x0000019668360000-memory.dmp
memory/484-242-0x0000019668370000-0x0000019668380000-memory.dmp
memory/484-223-0x0000019668330000-0x0000019668340000-memory.dmp
memory/484-221-0x0000019666850000-0x0000019666851000-memory.dmp
memory/484-202-0x00000196680C0000-0x0000019668330000-memory.dmp
memory/3604-266-0x000002067B5D0000-0x000002067B5D1000-memory.dmp
memory/3604-269-0x000002067B5D0000-0x000002067B5D1000-memory.dmp