Analysis
- max time kernel
145s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
30/07/2024, 02:00
General
- Target 7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc.jar
- Size 400KB
- Sample240730-ce6v6ascnl
- SHA256 7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
7dbd3729dd6c23e0329158520fa3cfcd3d78126f901aacad8a249a2166638fcc.jar
jna8250705207335289133.dll
83aa4cc77f591dfc2374580bbd95f6ba_a18f179e-3e6f-4f43-8bbf-9eee996556bc
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1684-104-0x000001FB00450000-0x000001FB00460000-memory.dmp
memory/1684-54-0x000001FB00370000-0x000001FB00380000-memory.dmp
memory/1684-20-0x000001FB002A0000-0x000001FB002B0000-memory.dmp
memory/1684-23-0x000001FB002C0000-0x000001FB002D0000-memory.dmp
memory/1684-25-0x000001FB002D0000-0x000001FB002E0000-memory.dmp
memory/1684-29-0x000001FB002F0000-0x000001FB00300000-memory.dmp
memory/1684-27-0x000001FB002E0000-0x000001FB002F0000-memory.dmp
memory/1684-31-0x000001FB00300000-0x000001FB00310000-memory.dmp
memory/1684-35-0x000001FB00310000-0x000001FB00320000-memory.dmp
memory/1684-38-0x000001FB00280000-0x000001FB00290000-memory.dmp
memory/1684-37-0x000001FB00270000-0x000001FB00280000-memory.dmp
memory/1684-36-0x000001FB00320000-0x000001FB00330000-memory.dmp
memory/1684-34-0x000001FB00000000-0x000001FB00270000-memory.dmp
memory/1684-42-0x000001FB00330000-0x000001FB00340000-memory.dmp
memory/1684-41-0x000001FB002A0000-0x000001FB002B0000-memory.dmp
memory/1684-40-0x000001FB00290000-0x000001FB002A0000-memory.dmp
memory/1684-45-0x000001FB00340000-0x000001FB00350000-memory.dmp
memory/1684-47-0x000001FB00350000-0x000001FB00360000-memory.dmp
memory/1684-46-0x000001FB002B0000-0x000001FB002C0000-memory.dmp
memory/1684-51-0x000001FB00360000-0x000001FB00370000-memory.dmp
memory/1684-50-0x000001FB002C0000-0x000001FB002D0000-memory.dmp
memory/1684-110-0x000001FB00470000-0x000001FB00480000-memory.dmp
memory/1684-53-0x000001FB002D0000-0x000001FB002E0000-memory.dmp
memory/1684-61-0x000001FB00380000-0x000001FB00390000-memory.dmp
memory/1684-60-0x000001FB002E0000-0x000001FB002F0000-memory.dmp
memory/1684-109-0x000001FB00460000-0x000001FB00470000-memory.dmp
memory/1684-67-0x000001FB003A0000-0x000001FB003B0000-memory.dmp
memory/1684-71-0x000001FB003C0000-0x000001FB003D0000-memory.dmp
memory/1684-70-0x000001FB00300000-0x000001FB00310000-memory.dmp
memory/1684-66-0x000001FB00390000-0x000001FB003A0000-memory.dmp
memory/1684-69-0x000001FB003B0000-0x000001FB003C0000-memory.dmp
memory/1684-75-0x000001FB00310000-0x000001FB00320000-memory.dmp
memory/1684-77-0x000001FB003E0000-0x000001FB003F0000-memory.dmp
memory/1684-80-0x000001FB003F0000-0x000001FB00400000-memory.dmp
memory/1684-79-0x000001FB00320000-0x000001FB00330000-memory.dmp
memory/1684-76-0x000001FB003D0000-0x000001FB003E0000-memory.dmp
memory/1684-81-0x000001FB00330000-0x000001FB00340000-memory.dmp
memory/1684-82-0x000001FB00400000-0x000001FB00410000-memory.dmp
memory/1684-86-0x000001FB00410000-0x000001FB00420000-memory.dmp
memory/1684-85-0x000001FB00340000-0x000001FB00350000-memory.dmp
memory/1684-111-0x000001FB00480000-0x000001FB00490000-memory.dmp
memory/1684-91-0x000001FB00420000-0x000001FB00430000-memory.dmp
memory/1684-92-0x000001FB00360000-0x000001FB00370000-memory.dmp
memory/1684-93-0x000001FB00430000-0x000001FB00440000-memory.dmp
memory/1684-94-0x000001FB79B80000-0x000001FB79B81000-memory.dmp
memory/1684-97-0x000001FB00440000-0x000001FB00450000-memory.dmp
memory/1684-96-0x000001FB00370000-0x000001FB00380000-memory.dmp
memory/1684-17-0x000001FB00290000-0x000001FB002A0000-memory.dmp
memory/1684-103-0x000001FB003B0000-0x000001FB003C0000-memory.dmp
memory/1684-102-0x000001FB00380000-0x000001FB00390000-memory.dmp
memory/1684-90-0x000001FB00350000-0x000001FB00360000-memory.dmp
memory/1684-21-0x000001FB002B0000-0x000001FB002C0000-memory.dmp
memory/1684-65-0x000001FB002F0000-0x000001FB00300000-memory.dmp
memory/1684-108-0x000001FB003A0000-0x000001FB003B0000-memory.dmp
memory/1684-107-0x000001FB00390000-0x000001FB003A0000-memory.dmp
memory/1684-119-0x000001FB004B0000-0x000001FB004C0000-memory.dmp
memory/1684-118-0x000001FB004A0000-0x000001FB004B0000-memory.dmp
memory/1684-117-0x000001FB00490000-0x000001FB004A0000-memory.dmp
memory/1684-116-0x000001FB003C0000-0x000001FB003D0000-memory.dmp
memory/1684-120-0x000001FB003D0000-0x000001FB003E0000-memory.dmp
memory/1684-126-0x000001FB79B80000-0x000001FB79B81000-memory.dmp
memory/1684-122-0x000001FB004C0000-0x000001FB004D0000-memory.dmp
memory/1684-121-0x000001FB003E0000-0x000001FB003F0000-memory.dmp
memory/1684-130-0x000001FB004D0000-0x000001FB004E0000-memory.dmp
memory/1684-129-0x000001FB003F0000-0x000001FB00400000-memory.dmp
memory/1684-133-0x000001FB004E0000-0x000001FB004F0000-memory.dmp
memory/1684-132-0x000001FB00400000-0x000001FB00410000-memory.dmp
memory/1684-135-0x000001FB00410000-0x000001FB00420000-memory.dmp
memory/1684-136-0x000001FB004F0000-0x000001FB00500000-memory.dmp
memory/1684-138-0x000001FB00420000-0x000001FB00430000-memory.dmp
memory/1684-139-0x000001FB00500000-0x000001FB00510000-memory.dmp
memory/1684-142-0x000001FB00510000-0x000001FB00520000-memory.dmp
memory/1684-141-0x000001FB00430000-0x000001FB00440000-memory.dmp
memory/1684-145-0x000001FB00440000-0x000001FB00450000-memory.dmp
memory/1684-148-0x000001FB00450000-0x000001FB00460000-memory.dmp
memory/1684-147-0x000001FB00530000-0x000001FB00540000-memory.dmp
memory/1684-146-0x000001FB00520000-0x000001FB00530000-memory.dmp
memory/1684-150-0x000001FB00460000-0x000001FB00470000-memory.dmp
memory/1684-151-0x000001FB00470000-0x000001FB00480000-memory.dmp
memory/1684-153-0x000001FB00540000-0x000001FB00550000-memory.dmp
memory/1684-152-0x000001FB00480000-0x000001FB00490000-memory.dmp
memory/1684-154-0x000001FB79B80000-0x000001FB79B81000-memory.dmp
memory/1684-159-0x000001FB00490000-0x000001FB004A0000-memory.dmp
memory/1684-160-0x000001FB004A0000-0x000001FB004B0000-memory.dmp
memory/1684-162-0x000001FB00550000-0x000001FB00560000-memory.dmp
memory/1684-161-0x000001FB004B0000-0x000001FB004C0000-memory.dmp
memory/1684-167-0x000001FB004C0000-0x000001FB004D0000-memory.dmp
memory/1684-168-0x000001FB00560000-0x000001FB00570000-memory.dmp
memory/1684-173-0x000001FB79B80000-0x000001FB79B81000-memory.dmp
memory/1684-174-0x000001FB004D0000-0x000001FB004E0000-memory.dmp
memory/1684-177-0x000001FB79B80000-0x000001FB79B81000-memory.dmp
memory/1684-184-0x000001FB002A0000-0x000001FB002B0000-memory.dmp
memory/1684-183-0x000001FB002B0000-0x000001FB002C0000-memory.dmp
memory/1684-14-0x000001FB00270000-0x000001FB00280000-memory.dmp
memory/1684-182-0x000001FB00290000-0x000001FB002A0000-memory.dmp
memory/1684-181-0x000001FB00280000-0x000001FB00290000-memory.dmp
memory/1684-180-0x000001FB00270000-0x000001FB00280000-memory.dmp
memory/1684-185-0x000001FB002C0000-0x000001FB002D0000-memory.dmp
memory/1684-179-0x000001FB00320000-0x000001FB00330000-memory.dmp
memory/1684-2-0x000001FB00000000-0x000001FB00270000-memory.dmp
memory/1684-15-0x000001FB00280000-0x000001FB00290000-memory.dmp
memory/1684-11-0x000001FB79B80000-0x000001FB79B81000-memory.dmp
memory/2300-349-0x0000021E64EF0000-0x0000021E64EF1000-memory.dmp
memory/4144-239-0x0000021DF1DF0000-0x0000021DF1DF1000-memory.dmp