Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 07:15
General
- Target PO2024-0961.jar
- Size 400KB
- Sample240729-h3f8assdma
- SHA256 7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\PO2024-0961.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\PO2024-0961.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO2024-0961.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO2024-0961.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\PO2024-0961.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
jna8122871724772161273.dll
83aa4cc77f591dfc2374580bbd95f6ba_46967d70-72aa-405b-b21a-7603bc5aaaad
PO2024-0961.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/400-127-0x0000019916770000-0x0000019916780000-memory.dmp
memory/400-302-0x0000019916760000-0x0000019916770000-memory.dmp
memory/400-23-0x00000199166C0000-0x00000199166D0000-memory.dmp
memory/400-26-0x00000199166D0000-0x00000199166E0000-memory.dmp
memory/400-27-0x00000199166E0000-0x00000199166F0000-memory.dmp
memory/400-30-0x00000199166F0000-0x0000019916700000-memory.dmp
memory/400-32-0x0000019916700000-0x0000019916710000-memory.dmp
memory/400-31-0x0000019916420000-0x0000019916690000-memory.dmp
memory/400-36-0x0000019916720000-0x0000019916730000-memory.dmp
memory/400-35-0x0000019916710000-0x0000019916720000-memory.dmp
memory/400-38-0x0000019916690000-0x00000199166A0000-memory.dmp
memory/400-39-0x0000019916730000-0x0000019916740000-memory.dmp
memory/400-41-0x00000199166A0000-0x00000199166B0000-memory.dmp
memory/400-42-0x0000019916740000-0x0000019916750000-memory.dmp
memory/400-44-0x0000019914BC0000-0x0000019914BC1000-memory.dmp
memory/400-48-0x0000019914BC0000-0x0000019914BC1000-memory.dmp
memory/400-52-0x00000199166B0000-0x00000199166C0000-memory.dmp
memory/400-54-0x0000019916750000-0x0000019916760000-memory.dmp
memory/400-59-0x0000019916760000-0x0000019916770000-memory.dmp
memory/400-58-0x00000199166D0000-0x00000199166E0000-memory.dmp
memory/400-62-0x0000019916780000-0x0000019916790000-memory.dmp
memory/400-61-0x0000019916770000-0x0000019916780000-memory.dmp
memory/400-57-0x00000199166C0000-0x00000199166D0000-memory.dmp
memory/400-65-0x00000199166E0000-0x00000199166F0000-memory.dmp
memory/400-66-0x0000019916790000-0x00000199167A0000-memory.dmp
memory/400-69-0x00000199167A0000-0x00000199167B0000-memory.dmp
memory/400-68-0x00000199166F0000-0x0000019916700000-memory.dmp
memory/400-70-0x0000019916700000-0x0000019916710000-memory.dmp
memory/400-71-0x00000199167B0000-0x00000199167C0000-memory.dmp
memory/400-74-0x0000019916710000-0x0000019916720000-memory.dmp
memory/400-76-0x00000199167D0000-0x00000199167E0000-memory.dmp
memory/400-75-0x00000199167C0000-0x00000199167D0000-memory.dmp
memory/400-79-0x0000019916720000-0x0000019916730000-memory.dmp
memory/400-81-0x0000019916730000-0x0000019916740000-memory.dmp
memory/400-82-0x00000199167F0000-0x0000019916800000-memory.dmp
memory/400-80-0x00000199167E0000-0x00000199167F0000-memory.dmp
memory/400-87-0x0000019916740000-0x0000019916750000-memory.dmp
memory/400-88-0x0000019916800000-0x0000019916810000-memory.dmp
memory/400-92-0x0000019914BC0000-0x0000019914BC1000-memory.dmp
memory/400-95-0x0000019914BC0000-0x0000019914BC1000-memory.dmp
memory/400-101-0x0000019916750000-0x0000019916760000-memory.dmp
memory/400-103-0x0000019916810000-0x0000019916820000-memory.dmp
memory/400-105-0x0000019916820000-0x0000019916830000-memory.dmp
memory/400-104-0x0000019916760000-0x0000019916770000-memory.dmp
memory/400-106-0x0000019914BC0000-0x0000019914BC1000-memory.dmp
memory/400-129-0x0000019916830000-0x0000019916840000-memory.dmp
memory/400-128-0x0000019916780000-0x0000019916790000-memory.dmp
memory/400-18-0x00000199166A0000-0x00000199166B0000-memory.dmp
memory/400-139-0x0000019916840000-0x0000019916850000-memory.dmp
memory/400-134-0x0000019916790000-0x00000199167A0000-memory.dmp
memory/400-20-0x00000199166B0000-0x00000199166C0000-memory.dmp
memory/400-155-0x00000199167A0000-0x00000199167B0000-memory.dmp
memory/400-300-0x0000019916740000-0x0000019916750000-memory.dmp
memory/400-195-0x0000019916860000-0x0000019916870000-memory.dmp
memory/400-212-0x00000199167C0000-0x00000199167D0000-memory.dmp
memory/400-213-0x00000199167D0000-0x00000199167E0000-memory.dmp
memory/400-215-0x0000019916870000-0x0000019916880000-memory.dmp
memory/400-244-0x0000019916890000-0x00000199168A0000-memory.dmp
memory/400-243-0x0000019916880000-0x0000019916890000-memory.dmp
memory/400-242-0x00000199167E0000-0x00000199167F0000-memory.dmp
memory/400-249-0x00000199167F0000-0x0000019916800000-memory.dmp
memory/400-251-0x00000199168B0000-0x00000199168C0000-memory.dmp
memory/400-250-0x00000199168A0000-0x00000199168B0000-memory.dmp
memory/400-255-0x00000199168C0000-0x00000199168D0000-memory.dmp
memory/400-253-0x0000019916800000-0x0000019916810000-memory.dmp
memory/400-264-0x00000199168E0000-0x00000199168F0000-memory.dmp
memory/400-263-0x00000199168D0000-0x00000199168E0000-memory.dmp
memory/400-257-0x0000019916810000-0x0000019916820000-memory.dmp
memory/400-275-0x0000019916820000-0x0000019916830000-memory.dmp
memory/400-280-0x0000019916830000-0x0000019916840000-memory.dmp
memory/400-284-0x0000019916840000-0x0000019916850000-memory.dmp
memory/400-285-0x00000199168F0000-0x0000019916900000-memory.dmp
memory/400-297-0x0000019916710000-0x0000019916720000-memory.dmp
memory/400-299-0x0000019916730000-0x0000019916740000-memory.dmp
memory/400-316-0x0000019916820000-0x0000019916830000-memory.dmp
memory/400-315-0x0000019916810000-0x0000019916820000-memory.dmp
memory/400-313-0x0000019916800000-0x0000019916810000-memory.dmp
memory/400-312-0x00000199167F0000-0x0000019916800000-memory.dmp
memory/400-311-0x00000199167E0000-0x00000199167F0000-memory.dmp
memory/400-309-0x00000199167D0000-0x00000199167E0000-memory.dmp
memory/400-308-0x00000199167C0000-0x00000199167D0000-memory.dmp
memory/400-307-0x00000199167B0000-0x00000199167C0000-memory.dmp
memory/400-306-0x00000199167A0000-0x00000199167B0000-memory.dmp
memory/400-305-0x0000019916790000-0x00000199167A0000-memory.dmp
memory/400-304-0x0000019916780000-0x0000019916790000-memory.dmp
memory/400-303-0x0000019916770000-0x0000019916780000-memory.dmp
memory/400-156-0x0000019916850000-0x0000019916860000-memory.dmp
memory/400-194-0x00000199167B0000-0x00000199167C0000-memory.dmp
memory/400-298-0x00000199166D0000-0x00000199166E0000-memory.dmp
memory/400-301-0x0000019916750000-0x0000019916760000-memory.dmp
memory/400-296-0x0000019916700000-0x0000019916710000-memory.dmp
memory/400-295-0x00000199166F0000-0x0000019916700000-memory.dmp
memory/400-294-0x00000199166E0000-0x00000199166F0000-memory.dmp
memory/400-293-0x0000019916720000-0x0000019916730000-memory.dmp
memory/400-292-0x00000199166C0000-0x00000199166D0000-memory.dmp
memory/400-291-0x00000199166B0000-0x00000199166C0000-memory.dmp
memory/400-290-0x00000199166A0000-0x00000199166B0000-memory.dmp
memory/400-289-0x0000019916690000-0x00000199166A0000-memory.dmp
memory/400-288-0x0000019916420000-0x0000019916690000-memory.dmp
memory/400-16-0x0000019916690000-0x00000199166A0000-memory.dmp
memory/400-12-0x0000019914BC0000-0x0000019914BC1000-memory.dmp
memory/400-11-0x0000019914BC0000-0x0000019914BC1000-memory.dmp
memory/400-2-0x0000019916420000-0x0000019916690000-memory.dmp