Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
19/07/2024, 10:17
General
- Target RFQ_PO#63765GMD_87.jar
- Size 400KB
- Sample240719-mbdejszapf
- SHA256 5d7324050d7c666402cfc29f6f76bb56585a81ad546a2c1a1c0f17dca958af96
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\RFQ_PO#63765GMD_87.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\RFQ_PO#63765GMD_87.jar"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\RFQ_PO#63765GMD_87.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\RFQ_PO#63765GMD_87.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\RFQ_PO#63765GMD_87.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna4124968487940603174.dll
83aa4cc77f591dfc2374580bbd95f6ba_58a5be6a-fbdc-4fe6-8f93-5aa44c9d3351
RFQ_PO#63765GMD_87.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/2012-349-0x000001FD90860000-0x000001FD90861000-memory.dmp
memory/3004-99-0x00000275906B0000-0x00000275906C0000-memory.dmp
memory/3004-195-0x00000275905D0000-0x00000275905E0000-memory.dmp
memory/3004-27-0x00000275905F0000-0x0000027590600000-memory.dmp
memory/3004-29-0x0000027590610000-0x0000027590620000-memory.dmp
memory/3004-26-0x0000027590600000-0x0000027590610000-memory.dmp
memory/3004-25-0x00000275905E0000-0x00000275905F0000-memory.dmp
memory/3004-33-0x0000027590620000-0x0000027590630000-memory.dmp
memory/3004-31-0x0000027590320000-0x0000027590590000-memory.dmp
memory/3004-34-0x0000027590630000-0x0000027590640000-memory.dmp
memory/3004-36-0x0000027590640000-0x0000027590650000-memory.dmp
memory/3004-38-0x0000027590590000-0x00000275905A0000-memory.dmp
memory/3004-40-0x0000027590650000-0x0000027590660000-memory.dmp
memory/3004-39-0x00000275905A0000-0x00000275905B0000-memory.dmp
memory/3004-45-0x00000275905B0000-0x00000275905C0000-memory.dmp
memory/3004-47-0x0000027590670000-0x0000027590680000-memory.dmp
memory/3004-46-0x0000027590660000-0x0000027590670000-memory.dmp
memory/3004-52-0x0000027590680000-0x0000027590690000-memory.dmp
memory/3004-51-0x00000275905C0000-0x00000275905D0000-memory.dmp
memory/3004-55-0x00000275905D0000-0x00000275905E0000-memory.dmp
memory/3004-56-0x0000027590690000-0x00000275906A0000-memory.dmp
memory/3004-58-0x00000275905E0000-0x00000275905F0000-memory.dmp
memory/3004-61-0x00000275906B0000-0x00000275906C0000-memory.dmp
memory/3004-60-0x00000275906A0000-0x00000275906B0000-memory.dmp
memory/3004-64-0x00000275906C0000-0x00000275906D0000-memory.dmp
memory/3004-63-0x00000275905F0000-0x0000027590600000-memory.dmp
memory/3004-59-0x0000027590600000-0x0000027590610000-memory.dmp
memory/3004-67-0x00000275906D0000-0x00000275906E0000-memory.dmp
memory/3004-66-0x0000027590610000-0x0000027590620000-memory.dmp
memory/3004-70-0x000002758EAB0000-0x000002758EAB1000-memory.dmp
memory/3004-71-0x0000027590620000-0x0000027590630000-memory.dmp
memory/3004-72-0x00000275906E0000-0x00000275906F0000-memory.dmp
memory/3004-75-0x00000275906F0000-0x0000027590700000-memory.dmp
memory/3004-74-0x0000027590630000-0x0000027590640000-memory.dmp
memory/3004-77-0x0000027590640000-0x0000027590650000-memory.dmp
memory/3004-80-0x0000027590650000-0x0000027590660000-memory.dmp
memory/3004-79-0x0000027590710000-0x0000027590720000-memory.dmp
memory/3004-78-0x0000027590700000-0x0000027590710000-memory.dmp
memory/3004-85-0x0000027590720000-0x0000027590730000-memory.dmp
memory/3004-84-0x0000027590670000-0x0000027590680000-memory.dmp
memory/3004-90-0x0000027590740000-0x0000027590750000-memory.dmp
memory/3004-94-0x0000027590750000-0x0000027590760000-memory.dmp
memory/3004-110-0x0000027590770000-0x0000027590780000-memory.dmp
memory/3004-93-0x0000027590690000-0x00000275906A0000-memory.dmp
memory/3004-88-0x0000027590680000-0x0000027590690000-memory.dmp
memory/3004-89-0x000002758EAB0000-0x000002758EAB1000-memory.dmp
memory/3004-100-0x0000027590760000-0x0000027590770000-memory.dmp
memory/3004-22-0x00000275905D0000-0x00000275905E0000-memory.dmp
memory/3004-98-0x00000275906A0000-0x00000275906B0000-memory.dmp
memory/3004-116-0x00000275907D0000-0x00000275907E0000-memory.dmp
memory/3004-115-0x00000275907C0000-0x00000275907D0000-memory.dmp
memory/3004-114-0x00000275907B0000-0x00000275907C0000-memory.dmp
memory/3004-113-0x00000275907A0000-0x00000275907B0000-memory.dmp
memory/3004-19-0x00000275905C0000-0x00000275905D0000-memory.dmp
memory/3004-112-0x0000027590790000-0x00000275907A0000-memory.dmp
memory/3004-92-0x0000027590730000-0x0000027590740000-memory.dmp
memory/3004-109-0x00000275906C0000-0x00000275906D0000-memory.dmp
memory/3004-121-0x000002758EAB0000-0x000002758EAB1000-memory.dmp
memory/3004-123-0x00000275906D0000-0x00000275906E0000-memory.dmp
memory/3004-124-0x00000275907E0000-0x00000275907F0000-memory.dmp
memory/3004-125-0x000002758EAB0000-0x000002758EAB1000-memory.dmp
memory/3004-128-0x00000275907F0000-0x0000027590800000-memory.dmp
memory/3004-127-0x00000275906E0000-0x00000275906F0000-memory.dmp
memory/3004-130-0x00000275906F0000-0x0000027590700000-memory.dmp
memory/3004-131-0x0000027590800000-0x0000027590810000-memory.dmp
memory/3004-133-0x0000027590700000-0x0000027590710000-memory.dmp
memory/3004-134-0x0000027590810000-0x0000027590820000-memory.dmp
memory/3004-135-0x000002758EAB0000-0x000002758EAB1000-memory.dmp
memory/3004-137-0x0000027590710000-0x0000027590720000-memory.dmp
memory/3004-138-0x0000027590820000-0x0000027590830000-memory.dmp
memory/3004-142-0x0000027590830000-0x0000027590840000-memory.dmp
memory/3004-141-0x0000027590730000-0x0000027590740000-memory.dmp
memory/3004-140-0x0000027590720000-0x0000027590730000-memory.dmp
memory/3004-145-0x0000027590740000-0x0000027590750000-memory.dmp
memory/3004-146-0x0000027590840000-0x0000027590850000-memory.dmp
memory/3004-148-0x0000027590750000-0x0000027590760000-memory.dmp
memory/3004-149-0x0000027590850000-0x0000027590860000-memory.dmp
memory/3004-154-0x0000027590760000-0x0000027590770000-memory.dmp
memory/3004-155-0x0000027590860000-0x0000027590870000-memory.dmp
memory/3004-157-0x0000027590770000-0x0000027590780000-memory.dmp
memory/3004-158-0x0000027590780000-0x0000027590790000-memory.dmp
memory/3004-160-0x00000275907A0000-0x00000275907B0000-memory.dmp
memory/3004-164-0x0000027590870000-0x0000027590880000-memory.dmp
memory/3004-163-0x00000275907D0000-0x00000275907E0000-memory.dmp
memory/3004-162-0x00000275907C0000-0x00000275907D0000-memory.dmp
memory/3004-161-0x00000275907B0000-0x00000275907C0000-memory.dmp
memory/3004-159-0x0000027590790000-0x00000275907A0000-memory.dmp
memory/3004-166-0x000002758EAB0000-0x000002758EAB1000-memory.dmp
memory/3004-172-0x00000275907E0000-0x00000275907F0000-memory.dmp
memory/3004-173-0x0000027590880000-0x0000027590890000-memory.dmp
memory/3004-177-0x00000275907F0000-0x0000027590800000-memory.dmp
memory/3004-187-0x0000027590800000-0x0000027590810000-memory.dmp
memory/3004-188-0x0000027590890000-0x00000275908A0000-memory.dmp
memory/3004-189-0x000002758EAB0000-0x000002758EAB1000-memory.dmp
memory/3004-111-0x0000027590780000-0x0000027590790000-memory.dmp
memory/3004-18-0x00000275905B0000-0x00000275905C0000-memory.dmp
memory/3004-194-0x00000275905F0000-0x0000027590600000-memory.dmp
memory/3004-193-0x00000275905B0000-0x00000275905C0000-memory.dmp
memory/3004-192-0x00000275905A0000-0x00000275905B0000-memory.dmp
memory/3004-191-0x0000027590590000-0x00000275905A0000-memory.dmp
memory/3004-190-0x00000275905C0000-0x00000275905D0000-memory.dmp
memory/3004-2-0x0000027590320000-0x0000027590590000-memory.dmp
memory/3004-15-0x00000275905A0000-0x00000275905B0000-memory.dmp
memory/3004-14-0x0000027590590000-0x00000275905A0000-memory.dmp
memory/3004-11-0x000002758EAB0000-0x000002758EAB1000-memory.dmp
memory/4404-257-0x00000128B0A40000-0x00000128B0A41000-memory.dmp