Analysis
- max time kernel
144s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
20/07/2024, 09:20
General
- Target 36fe8b9f65dae5e382f1e5cb7fc08fae30df707065a0e3615d753d0215439dc6.jar
- Size 400KB
- Sample240720-la1b9azaph
- SHA256 36fe8b9f65dae5e382f1e5cb7fc08fae30df707065a0e3615d753d0215439dc6
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\36fe8b9f65dae5e382f1e5cb7fc08fae30df707065a0e3615d753d0215439dc6.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\36fe8b9f65dae5e382f1e5cb7fc08fae30df707065a0e3615d753d0215439dc6.jar"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\36fe8b9f65dae5e382f1e5cb7fc08fae30df707065a0e3615d753d0215439dc6.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\36fe8b9f65dae5e382f1e5cb7fc08fae30df707065a0e3615d753d0215439dc6.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\36fe8b9f65dae5e382f1e5cb7fc08fae30df707065a0e3615d753d0215439dc6.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
36fe8b9f65dae5e382f1e5cb7fc08fae30df707065a0e3615d753d0215439dc6.jar
jna2601873021684831183.dll
83aa4cc77f591dfc2374580bbd95f6ba_9370e86d-1eb3-453f-8ea4-ee21ada11d8d
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/3644-306-0x00000243A3F40000-0x00000243A3F41000-memory.dmp
memory/3644-258-0x00000243A3F40000-0x00000243A3F41000-memory.dmp
memory/4120-104-0x000001CCC3460000-0x000001CCC3470000-memory.dmp
memory/4120-74-0x000001CCC3480000-0x000001CCC3490000-memory.dmp
memory/4120-112-0x000001CCC3530000-0x000001CCC3540000-memory.dmp
memory/4120-27-0x000001CCC3390000-0x000001CCC33A0000-memory.dmp
memory/4120-29-0x000001CCC33A0000-0x000001CCC33B0000-memory.dmp
memory/4120-26-0x000001CCC3380000-0x000001CCC3390000-memory.dmp
memory/4120-33-0x000001CCC33B0000-0x000001CCC33C0000-memory.dmp
memory/4120-32-0x000001CCC30B0000-0x000001CCC3320000-memory.dmp
memory/4120-35-0x000001CCC33C0000-0x000001CCC33D0000-memory.dmp
memory/4120-39-0x000001CCC33E0000-0x000001CCC33F0000-memory.dmp
memory/4120-38-0x000001CCC33D0000-0x000001CCC33E0000-memory.dmp
memory/4120-37-0x000001CCC3320000-0x000001CCC3330000-memory.dmp
memory/4120-43-0x000001CCC33F0000-0x000001CCC3400000-memory.dmp
memory/4120-42-0x000001CCC3340000-0x000001CCC3350000-memory.dmp
memory/4120-41-0x000001CCC3330000-0x000001CCC3340000-memory.dmp
memory/4120-51-0x000001CCC3410000-0x000001CCC3420000-memory.dmp
memory/4120-50-0x000001CCC3400000-0x000001CCC3410000-memory.dmp
memory/4120-49-0x000001CCC3350000-0x000001CCC3360000-memory.dmp
memory/4120-55-0x000001CCC3360000-0x000001CCC3370000-memory.dmp
memory/4120-56-0x000001CCC3420000-0x000001CCC3430000-memory.dmp
memory/4120-58-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4120-62-0x000001CCC3440000-0x000001CCC3450000-memory.dmp
memory/4120-61-0x000001CCC3430000-0x000001CCC3440000-memory.dmp
memory/4120-60-0x000001CCC3370000-0x000001CCC3380000-memory.dmp
memory/4120-64-0x000001CCC3450000-0x000001CCC3460000-memory.dmp
memory/4120-63-0x000001CCC3380000-0x000001CCC3390000-memory.dmp
memory/4120-68-0x000001CCC3460000-0x000001CCC3470000-memory.dmp
memory/4120-67-0x000001CCC3390000-0x000001CCC33A0000-memory.dmp
memory/4120-71-0x000001CCC3470000-0x000001CCC3480000-memory.dmp
memory/4120-70-0x000001CCC33A0000-0x000001CCC33B0000-memory.dmp
memory/4120-111-0x000001CCC3480000-0x000001CCC3490000-memory.dmp
memory/4120-73-0x000001CCC33B0000-0x000001CCC33C0000-memory.dmp
memory/4120-75-0x000001CCC33C0000-0x000001CCC33D0000-memory.dmp
memory/4120-76-0x000001CCC3490000-0x000001CCC34A0000-memory.dmp
memory/4120-80-0x000001CCC34A0000-0x000001CCC34B0000-memory.dmp
memory/4120-79-0x000001CCC33E0000-0x000001CCC33F0000-memory.dmp
memory/4120-78-0x000001CCC33D0000-0x000001CCC33E0000-memory.dmp
memory/4120-84-0x000001CCC33F0000-0x000001CCC3400000-memory.dmp
memory/4120-85-0x000001CCC34B0000-0x000001CCC34C0000-memory.dmp
memory/4120-88-0x000001CCC3410000-0x000001CCC3420000-memory.dmp
memory/4120-89-0x000001CCC34C0000-0x000001CCC34D0000-memory.dmp
memory/4120-91-0x000001CCC34D0000-0x000001CCC34E0000-memory.dmp
memory/4120-109-0x000001CCC3470000-0x000001CCC3480000-memory.dmp
memory/4120-96-0x000001CCC34E0000-0x000001CCC34F0000-memory.dmp
memory/4120-95-0x000001CCC3440000-0x000001CCC3450000-memory.dmp
memory/4120-94-0x000001CCC3430000-0x000001CCC3440000-memory.dmp
memory/4120-100-0x000001CCC3450000-0x000001CCC3460000-memory.dmp
memory/4120-101-0x000001CCC34F0000-0x000001CCC3500000-memory.dmp
memory/4120-20-0x000001CCC3350000-0x000001CCC3360000-memory.dmp
memory/4120-106-0x000001CCC3510000-0x000001CCC3520000-memory.dmp
memory/4120-105-0x000001CCC3500000-0x000001CCC3510000-memory.dmp
memory/4120-110-0x000001CCC3520000-0x000001CCC3530000-memory.dmp
memory/4120-90-0x000001CCC3420000-0x000001CCC3430000-memory.dmp
memory/4120-21-0x000001CCC3360000-0x000001CCC3370000-memory.dmp
memory/4120-24-0x000001CCC3370000-0x000001CCC3380000-memory.dmp
memory/4120-115-0x000001CCC3490000-0x000001CCC34A0000-memory.dmp
memory/4120-117-0x000001CCC3550000-0x000001CCC3560000-memory.dmp
memory/4120-116-0x000001CCC3540000-0x000001CCC3550000-memory.dmp
memory/4120-123-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4120-125-0x000001CCC34A0000-0x000001CCC34B0000-memory.dmp
memory/4120-126-0x000001CCC3560000-0x000001CCC3570000-memory.dmp
memory/4120-124-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4120-128-0x000001CCC34B0000-0x000001CCC34C0000-memory.dmp
memory/4120-129-0x000001CCC3570000-0x000001CCC3580000-memory.dmp
memory/4120-131-0x000001CCC34C0000-0x000001CCC34D0000-memory.dmp
memory/4120-132-0x000001CCC3580000-0x000001CCC3590000-memory.dmp
memory/4120-135-0x000001CCC3590000-0x000001CCC35A0000-memory.dmp
memory/4120-134-0x000001CCC34D0000-0x000001CCC34E0000-memory.dmp
memory/4120-137-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4120-138-0x000001CCC34E0000-0x000001CCC34F0000-memory.dmp
memory/4120-139-0x000001CCC35A0000-0x000001CCC35B0000-memory.dmp
memory/4120-142-0x000001CCC34F0000-0x000001CCC3500000-memory.dmp
memory/4120-143-0x000001CCC35B0000-0x000001CCC35C0000-memory.dmp
memory/4120-145-0x000001CCC3500000-0x000001CCC3510000-memory.dmp
memory/4120-147-0x000001CCC35C0000-0x000001CCC35D0000-memory.dmp
memory/4120-146-0x000001CCC3510000-0x000001CCC3520000-memory.dmp
memory/4120-148-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4120-151-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4120-155-0x000001CCC3520000-0x000001CCC3530000-memory.dmp
memory/4120-156-0x000001CCC35D0000-0x000001CCC35E0000-memory.dmp
memory/4120-157-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4120-159-0x000001CCC3530000-0x000001CCC3540000-memory.dmp
memory/4120-160-0x000001CCC35E0000-0x000001CCC35F0000-memory.dmp
memory/4120-162-0x000001CCC3540000-0x000001CCC3550000-memory.dmp
memory/4120-164-0x000001CCC35F0000-0x000001CCC3600000-memory.dmp
memory/4120-163-0x000001CCC3550000-0x000001CCC3560000-memory.dmp
memory/4120-169-0x000001CCC3560000-0x000001CCC3570000-memory.dmp
memory/4120-170-0x000001CCC3570000-0x000001CCC3580000-memory.dmp
memory/4120-171-0x000001CCC3600000-0x000001CCC3610000-memory.dmp
memory/4120-179-0x000001CCC3580000-0x000001CCC3590000-memory.dmp
memory/4120-180-0x000001CCC3590000-0x000001CCC35A0000-memory.dmp
memory/4120-186-0x000001CCC35A0000-0x000001CCC35B0000-memory.dmp
memory/4120-190-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4120-192-0x000001CCC3610000-0x000001CCC3620000-memory.dmp
memory/4120-197-0x000001CCC3350000-0x000001CCC3360000-memory.dmp
memory/4120-196-0x000001CCC3340000-0x000001CCC3350000-memory.dmp
memory/4120-16-0x000001CCC3330000-0x000001CCC3340000-memory.dmp
memory/4120-17-0x000001CCC3340000-0x000001CCC3350000-memory.dmp
memory/4120-13-0x000001CCC3320000-0x000001CCC3330000-memory.dmp
memory/4120-195-0x000001CCC3330000-0x000001CCC3340000-memory.dmp
memory/4120-194-0x000001CCC3320000-0x000001CCC3330000-memory.dmp
memory/4120-193-0x000001CCC3390000-0x000001CCC33A0000-memory.dmp
memory/4120-191-0x000001CCC35B0000-0x000001CCC35C0000-memory.dmp
memory/4120-2-0x000001CCC30B0000-0x000001CCC3320000-memory.dmp
memory/4120-11-0x000001CCC18A0000-0x000001CCC18A1000-memory.dmp
memory/4352-360-0x0000021A10BC0000-0x0000021A10BC1000-memory.dmp