Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
30/07/2024, 16:11
General
- Target 4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd.jar
- Size 400KB
- Sample240730-tm3l5ssbja
- SHA256 4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd.jar
jna6522987558106625299.dll
83aa4cc77f591dfc2374580bbd95f6ba_89cda556-130e-4f17-88ab-af18fe5b92e6
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/2292-112-0x000002458B370000-0x000002458B380000-memory.dmp
memory/2292-181-0x000002458B180000-0x000002458B190000-memory.dmp
memory/2292-24-0x000002458B1A0000-0x000002458B1B0000-memory.dmp
memory/2292-23-0x000002458B190000-0x000002458B1A0000-memory.dmp
memory/2292-25-0x000002458B1B0000-0x000002458B1C0000-memory.dmp
memory/2292-29-0x000002458B1D0000-0x000002458B1E0000-memory.dmp
memory/2292-28-0x000002458B1C0000-0x000002458B1D0000-memory.dmp
memory/2292-31-0x000002458B1E0000-0x000002458B1F0000-memory.dmp
memory/2292-41-0x000002458B220000-0x000002458B230000-memory.dmp
memory/2292-40-0x000002458AEE0000-0x000002458B150000-memory.dmp
memory/2292-38-0x000002458B210000-0x000002458B220000-memory.dmp
memory/2292-37-0x000002458B200000-0x000002458B210000-memory.dmp
memory/2292-36-0x000002458B1F0000-0x000002458B200000-memory.dmp
memory/2292-44-0x000002458B240000-0x000002458B250000-memory.dmp
memory/2292-43-0x000002458B230000-0x000002458B240000-memory.dmp
memory/2292-51-0x000002458B250000-0x000002458B260000-memory.dmp
memory/2292-50-0x000002458B150000-0x000002458B160000-memory.dmp
memory/2292-59-0x000002458B280000-0x000002458B290000-memory.dmp
memory/2292-58-0x000002458B270000-0x000002458B280000-memory.dmp
memory/2292-64-0x000002458B290000-0x000002458B2A0000-memory.dmp
memory/2292-63-0x000002458B180000-0x000002458B190000-memory.dmp
memory/2292-74-0x000002458B2D0000-0x000002458B2E0000-memory.dmp
memory/2292-73-0x000002458B2C0000-0x000002458B2D0000-memory.dmp
memory/2292-72-0x000002458B2B0000-0x000002458B2C0000-memory.dmp
memory/2292-71-0x000002458B1A0000-0x000002458B1B0000-memory.dmp
memory/2292-70-0x000002458B190000-0x000002458B1A0000-memory.dmp
memory/2292-60-0x000002458AEC0000-0x000002458AEC1000-memory.dmp
memory/2292-65-0x000002458B2A0000-0x000002458B2B0000-memory.dmp
memory/2292-62-0x000002458B170000-0x000002458B180000-memory.dmp
memory/2292-57-0x000002458B260000-0x000002458B270000-memory.dmp
memory/2292-56-0x000002458B160000-0x000002458B170000-memory.dmp
memory/2292-77-0x000002458B2E0000-0x000002458B2F0000-memory.dmp
memory/2292-76-0x000002458B1B0000-0x000002458B1C0000-memory.dmp
memory/2292-81-0x000002458B1D0000-0x000002458B1E0000-memory.dmp
memory/2292-80-0x000002458B1C0000-0x000002458B1D0000-memory.dmp
memory/2292-84-0x000002458B2F0000-0x000002458B300000-memory.dmp
memory/2292-85-0x000002458B1E0000-0x000002458B1F0000-memory.dmp
memory/2292-87-0x000002458B300000-0x000002458B310000-memory.dmp
memory/2292-86-0x000002458B210000-0x000002458B220000-memory.dmp
memory/2292-96-0x000002458B220000-0x000002458B230000-memory.dmp
memory/2292-95-0x000002458B320000-0x000002458B330000-memory.dmp
memory/2292-94-0x000002458B310000-0x000002458B320000-memory.dmp
memory/2292-103-0x000002458B340000-0x000002458B350000-memory.dmp
memory/2292-108-0x000002458B360000-0x000002458B370000-memory.dmp
memory/2292-107-0x000002458B350000-0x000002458B360000-memory.dmp
memory/2292-106-0x000002458B250000-0x000002458B260000-memory.dmp
memory/2292-102-0x000002458B330000-0x000002458B340000-memory.dmp
memory/2292-100-0x000002458B240000-0x000002458B250000-memory.dmp
memory/2292-99-0x000002458B230000-0x000002458B240000-memory.dmp
memory/2292-19-0x000002458B180000-0x000002458B190000-memory.dmp
memory/2292-111-0x000002458B280000-0x000002458B290000-memory.dmp
memory/2292-110-0x000002458B270000-0x000002458B280000-memory.dmp
memory/2292-18-0x000002458B170000-0x000002458B180000-memory.dmp
memory/2292-109-0x000002458B260000-0x000002458B270000-memory.dmp
memory/2292-120-0x000002458B290000-0x000002458B2A0000-memory.dmp
memory/2292-117-0x000002458AEC0000-0x000002458AEC1000-memory.dmp
memory/2292-119-0x000002458AEC0000-0x000002458AEC1000-memory.dmp
memory/2292-121-0x000002458B2A0000-0x000002458B2B0000-memory.dmp
memory/2292-122-0x000002458B380000-0x000002458B390000-memory.dmp
memory/2292-92-0x000002458B1F0000-0x000002458B200000-memory.dmp
memory/2292-127-0x000002458B390000-0x000002458B3A0000-memory.dmp
memory/2292-126-0x000002458B2D0000-0x000002458B2E0000-memory.dmp
memory/2292-125-0x000002458B2C0000-0x000002458B2D0000-memory.dmp
memory/2292-124-0x000002458B2B0000-0x000002458B2C0000-memory.dmp
memory/2292-130-0x000002458B3A0000-0x000002458B3B0000-memory.dmp
memory/2292-129-0x000002458B2E0000-0x000002458B2F0000-memory.dmp
memory/2292-133-0x000002458B3B0000-0x000002458B3C0000-memory.dmp
memory/2292-132-0x000002458B2F0000-0x000002458B300000-memory.dmp
memory/2292-135-0x000002458AEC0000-0x000002458AEC1000-memory.dmp
memory/2292-137-0x000002458B3C0000-0x000002458B3D0000-memory.dmp
memory/2292-136-0x000002458B300000-0x000002458B310000-memory.dmp
memory/2292-139-0x000002458B310000-0x000002458B320000-memory.dmp
memory/2292-141-0x000002458B3D0000-0x000002458B3E0000-memory.dmp
memory/2292-145-0x000002458B3E0000-0x000002458B3F0000-memory.dmp
memory/2292-144-0x000002458B320000-0x000002458B330000-memory.dmp
memory/2292-146-0x000002458B330000-0x000002458B340000-memory.dmp
memory/2292-148-0x000002458B3F0000-0x000002458B400000-memory.dmp
memory/2292-147-0x000002458B340000-0x000002458B350000-memory.dmp
memory/2292-149-0x000002458AEC0000-0x000002458AEC1000-memory.dmp
memory/2292-154-0x000002458B350000-0x000002458B360000-memory.dmp
memory/2292-155-0x000002458B360000-0x000002458B370000-memory.dmp
memory/2292-156-0x000002458B400000-0x000002458B410000-memory.dmp
memory/2292-158-0x000002458B370000-0x000002458B380000-memory.dmp
memory/2292-159-0x000002458B410000-0x000002458B420000-memory.dmp
memory/2292-163-0x000002458B380000-0x000002458B390000-memory.dmp
memory/2292-164-0x000002458B420000-0x000002458B430000-memory.dmp
memory/2292-167-0x000002458AEC0000-0x000002458AEC1000-memory.dmp
memory/2292-171-0x000002458B390000-0x000002458B3A0000-memory.dmp
memory/2292-175-0x000002458AEC0000-0x000002458AEC1000-memory.dmp
memory/2292-176-0x000002458B160000-0x000002458B170000-memory.dmp
memory/2292-187-0x000002458B1E0000-0x000002458B1F0000-memory.dmp
memory/2292-186-0x000002458B1D0000-0x000002458B1E0000-memory.dmp
memory/2292-185-0x000002458B1C0000-0x000002458B1D0000-memory.dmp
memory/2292-184-0x000002458B1B0000-0x000002458B1C0000-memory.dmp
memory/2292-183-0x000002458B1A0000-0x000002458B1B0000-memory.dmp
memory/2292-182-0x000002458B190000-0x000002458B1A0000-memory.dmp
memory/2292-93-0x000002458B200000-0x000002458B210000-memory.dmp
memory/2292-14-0x000002458B150000-0x000002458B160000-memory.dmp
memory/2292-180-0x000002458B170000-0x000002458B180000-memory.dmp
memory/2292-179-0x000002458AEE0000-0x000002458B150000-memory.dmp
memory/2292-177-0x000002458B150000-0x000002458B160000-memory.dmp
memory/2292-2-0x000002458AEE0000-0x000002458B150000-memory.dmp
memory/2292-15-0x000002458B160000-0x000002458B170000-memory.dmp
memory/2292-11-0x000002458AEC0000-0x000002458AEC1000-memory.dmp
memory/2624-360-0x000001A444770000-0x000001A444771000-memory.dmp
memory/2624-376-0x000001A444770000-0x000001A444771000-memory.dmp
memory/4516-235-0x0000020C27910000-0x0000020C27911000-memory.dmp