Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2024 11:06

General

  • Target

    BESTELLSCHEIN N?24030979.jar

  • Size

    400KB

  • MD5

    8352685f41275e213e460ced90c988eb

  • SHA1

    66d7398a756d1829587b795511a6a601b17110b1

  • SHA256

    316032ba749aa4cda9f8db6963e9b8b6f10ef6e0a31760d716815cf79828ce55

  • SHA512

    e70ef25eccce76111dd2c0b7d2bc7f5130963fa65447ec5f596846e3a2cb4b47d45dd007cac2d66d30f32dcd9a18469012cf9a8cf208286d339f0d57f7cec0fb

  • SSDEEP

    12288:eLxmHTG54XfLDZcvv7f3JvyTcftP9iNiW:eNiTG5Gyj5vP9QT

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\BESTELLSCHEIN N_24030979.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\BESTELLSCHEIN N_24030979.jar"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\BESTELLSCHEIN N_24030979.jar"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\Windows\system32\schtasks.exe
          schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\BESTELLSCHEIN N_24030979.jar"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3520
      • C:\Program Files\Java\jre-1.8\bin\java.exe
        "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\BESTELLSCHEIN N_24030979.jar"
        3⤵
        • Drops startup file
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1608
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3528
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4812
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1172
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1468
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
            5⤵
              PID:4976
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1648
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
              5⤵
                PID:4588

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna4441954243445485426.dll

        Filesize

        241KB

        MD5

        e02979ecd43bcc9061eb2b494ab5af50

        SHA1

        3122ac0e751660f646c73b10c4f79685aa65c545

        SHA256

        a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a

        SHA512

        1e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2412658365-3084825385-3340777666-1000\83aa4cc77f591dfc2374580bbd95f6ba_dd06e985-ac7f-4567-b0c7-3752f03c29fc

        Filesize

        45B

        MD5

        c8366ae350e7019aefc9d1e6e6a498c6

        SHA1

        5731d8a3e6568a5f2dfbbc87e3db9637df280b61

        SHA256

        11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

        SHA512

        33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

      • C:\Users\Admin\BESTELLSCHEIN N_24030979.jar

        Filesize

        400KB

        MD5

        8352685f41275e213e460ced90c988eb

        SHA1

        66d7398a756d1829587b795511a6a601b17110b1

        SHA256

        316032ba749aa4cda9f8db6963e9b8b6f10ef6e0a31760d716815cf79828ce55

        SHA512

        e70ef25eccce76111dd2c0b7d2bc7f5130963fa65447ec5f596846e3a2cb4b47d45dd007cac2d66d30f32dcd9a18469012cf9a8cf208286d339f0d57f7cec0fb

      • C:\Users\Admin\lib\jna-5.5.0.jar

        Filesize

        1.4MB

        MD5

        acfb5b5fd9ee10bf69497792fd469f85

        SHA1

        0e0845217c4907822403912ad6828d8e0b256208

        SHA256

        b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e

        SHA512

        e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa

      • C:\Users\Admin\lib\jna-platform-5.5.0.jar

        Filesize

        2.6MB

        MD5

        2f4a99c2758e72ee2b59a73586a2322f

        SHA1

        af38e7c4d0fc73c23ecd785443705bfdee5b90bf

        SHA256

        24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5

        SHA512

        b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494

      • C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jar

        Filesize

        4.1MB

        MD5

        b33387e15ab150a7bf560abdc73c3bec

        SHA1

        66b8075784131f578ef893fd7674273f709b9a4c

        SHA256

        2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491

        SHA512

        25cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279

      • C:\Users\Admin\lib\system-hook-3.5.jar

        Filesize

        772KB

        MD5

        e1aa38a1e78a76a6de73efae136cdb3a

        SHA1

        c463da71871f780b2e2e5dba115d43953b537daf

        SHA256

        2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609

        SHA512

        fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d

      • memory/1352-101-0x000002B9E4A20000-0x000002B9E4A30000-memory.dmp

        Filesize

        64KB

      • memory/1352-184-0x000002B9E4AE0000-0x000002B9E4AF0000-memory.dmp

        Filesize

        64KB

      • memory/1352-18-0x000002B9E4870000-0x000002B9E4880000-memory.dmp

        Filesize

        64KB

      • memory/1352-105-0x000002B9E4970000-0x000002B9E4980000-memory.dmp

        Filesize

        64KB

      • memory/1352-22-0x000002B9E4890000-0x000002B9E48A0000-memory.dmp

        Filesize

        64KB

      • memory/1352-25-0x000002B9E48B0000-0x000002B9E48C0000-memory.dmp

        Filesize

        64KB

      • memory/1352-28-0x000002B9E48C0000-0x000002B9E48D0000-memory.dmp

        Filesize

        64KB

      • memory/1352-29-0x000002B9E48D0000-0x000002B9E48E0000-memory.dmp

        Filesize

        64KB

      • memory/1352-36-0x000002B9E4900000-0x000002B9E4910000-memory.dmp

        Filesize

        64KB

      • memory/1352-35-0x000002B9E48F0000-0x000002B9E4900000-memory.dmp

        Filesize

        64KB

      • memory/1352-34-0x000002B9E48E0000-0x000002B9E48F0000-memory.dmp

        Filesize

        64KB

      • memory/1352-41-0x000002B9E4930000-0x000002B9E4940000-memory.dmp

        Filesize

        64KB

      • memory/1352-40-0x000002B9E4920000-0x000002B9E4930000-memory.dmp

        Filesize

        64KB

      • memory/1352-39-0x000002B9E4910000-0x000002B9E4920000-memory.dmp

        Filesize

        64KB

      • memory/1352-43-0x000002B9E4940000-0x000002B9E4950000-memory.dmp

        Filesize

        64KB

      • memory/1352-51-0x000002B9E4960000-0x000002B9E4970000-memory.dmp

        Filesize

        64KB

      • memory/1352-50-0x000002B9E4950000-0x000002B9E4960000-memory.dmp

        Filesize

        64KB

      • memory/1352-55-0x000002B9E2D40000-0x000002B9E2D41000-memory.dmp

        Filesize

        4KB

      • memory/1352-61-0x000002B9E4860000-0x000002B9E4870000-memory.dmp

        Filesize

        64KB

      • memory/1352-60-0x000002B9E4850000-0x000002B9E4860000-memory.dmp

        Filesize

        64KB

      • memory/1352-59-0x000002B9E4990000-0x000002B9E49A0000-memory.dmp

        Filesize

        64KB

      • memory/1352-58-0x000002B9E4980000-0x000002B9E4990000-memory.dmp

        Filesize

        64KB

      • memory/1352-57-0x000002B9E4970000-0x000002B9E4980000-memory.dmp

        Filesize

        64KB

      • memory/1352-56-0x000002B9E45E0000-0x000002B9E4850000-memory.dmp

        Filesize

        2.4MB

      • memory/1352-66-0x000002B9E49A0000-0x000002B9E49B0000-memory.dmp

        Filesize

        64KB

      • memory/1352-65-0x000002B9E4880000-0x000002B9E4890000-memory.dmp

        Filesize

        64KB

      • memory/1352-64-0x000002B9E4870000-0x000002B9E4880000-memory.dmp

        Filesize

        64KB

      • memory/1352-70-0x000002B9E49B0000-0x000002B9E49C0000-memory.dmp

        Filesize

        64KB

      • memory/1352-69-0x000002B9E48A0000-0x000002B9E48B0000-memory.dmp

        Filesize

        64KB

      • memory/1352-68-0x000002B9E4890000-0x000002B9E48A0000-memory.dmp

        Filesize

        64KB

      • memory/1352-73-0x000002B9E49C0000-0x000002B9E49D0000-memory.dmp

        Filesize

        64KB

      • memory/1352-72-0x000002B9E48B0000-0x000002B9E48C0000-memory.dmp

        Filesize

        64KB

      • memory/1352-75-0x000002B9E48C0000-0x000002B9E48D0000-memory.dmp

        Filesize

        64KB

      • memory/1352-78-0x000002B9E49E0000-0x000002B9E49F0000-memory.dmp

        Filesize

        64KB

      • memory/1352-77-0x000002B9E49D0000-0x000002B9E49E0000-memory.dmp

        Filesize

        64KB

      • memory/1352-76-0x000002B9E48D0000-0x000002B9E48E0000-memory.dmp

        Filesize

        64KB

      • memory/1352-86-0x000002B9E49F0000-0x000002B9E4A00000-memory.dmp

        Filesize

        64KB

      • memory/1352-85-0x000002B9E4900000-0x000002B9E4910000-memory.dmp

        Filesize

        64KB

      • memory/1352-84-0x000002B9E48F0000-0x000002B9E4900000-memory.dmp

        Filesize

        64KB

      • memory/1352-83-0x000002B9E48E0000-0x000002B9E48F0000-memory.dmp

        Filesize

        64KB

      • memory/1352-88-0x000002B9E4910000-0x000002B9E4920000-memory.dmp

        Filesize

        64KB

      • memory/1352-89-0x000002B9E4920000-0x000002B9E4930000-memory.dmp

        Filesize

        64KB

      • memory/1352-91-0x000002B9E4A10000-0x000002B9E4A20000-memory.dmp

        Filesize

        64KB

      • memory/1352-90-0x000002B9E4930000-0x000002B9E4940000-memory.dmp

        Filesize

        64KB

      • memory/1352-93-0x000002B9E4940000-0x000002B9E4950000-memory.dmp

        Filesize

        64KB

      • memory/1352-94-0x000002B9E4A00000-0x000002B9E4A10000-memory.dmp

        Filesize

        64KB

      • memory/1352-100-0x000002B9E4960000-0x000002B9E4970000-memory.dmp

        Filesize

        64KB

      • memory/1352-99-0x000002B9E4950000-0x000002B9E4960000-memory.dmp

        Filesize

        64KB

      • memory/1352-15-0x000002B9E4850000-0x000002B9E4860000-memory.dmp

        Filesize

        64KB

      • memory/1352-102-0x000002B9E4A30000-0x000002B9E4A40000-memory.dmp

        Filesize

        64KB

      • memory/1352-107-0x000002B9E4A40000-0x000002B9E4A50000-memory.dmp

        Filesize

        64KB

      • memory/1352-106-0x000002B9E4980000-0x000002B9E4990000-memory.dmp

        Filesize

        64KB

      • memory/1352-23-0x000002B9E48A0000-0x000002B9E48B0000-memory.dmp

        Filesize

        64KB

      • memory/1352-19-0x000002B9E4880000-0x000002B9E4890000-memory.dmp

        Filesize

        64KB

      • memory/1352-164-0x000002B9E4A80000-0x000002B9E4A90000-memory.dmp

        Filesize

        64KB

      • memory/1352-111-0x000002B9E49A0000-0x000002B9E49B0000-memory.dmp

        Filesize

        64KB

      • memory/1352-112-0x000002B9E4A60000-0x000002B9E4A70000-memory.dmp

        Filesize

        64KB

      • memory/1352-116-0x000002B9E49B0000-0x000002B9E49C0000-memory.dmp

        Filesize

        64KB

      • memory/1352-119-0x000002B9E4A90000-0x000002B9E4AA0000-memory.dmp

        Filesize

        64KB

      • memory/1352-118-0x000002B9E4A80000-0x000002B9E4A90000-memory.dmp

        Filesize

        64KB

      • memory/1352-117-0x000002B9E4A70000-0x000002B9E4A80000-memory.dmp

        Filesize

        64KB

      • memory/1352-123-0x000002B9E2D40000-0x000002B9E2D41000-memory.dmp

        Filesize

        4KB

      • memory/1352-127-0x000002B9E4AA0000-0x000002B9E4AB0000-memory.dmp

        Filesize

        64KB

      • memory/1352-126-0x000002B9E49C0000-0x000002B9E49D0000-memory.dmp

        Filesize

        64KB

      • memory/1352-128-0x000002B9E2D40000-0x000002B9E2D41000-memory.dmp

        Filesize

        4KB

      • memory/1352-130-0x000002B9E49D0000-0x000002B9E49E0000-memory.dmp

        Filesize

        64KB

      • memory/1352-131-0x000002B9E49E0000-0x000002B9E49F0000-memory.dmp

        Filesize

        64KB

      • memory/1352-132-0x000002B9E4AB0000-0x000002B9E4AC0000-memory.dmp

        Filesize

        64KB

      • memory/1352-134-0x000002B9E49F0000-0x000002B9E4A00000-memory.dmp

        Filesize

        64KB

      • memory/1352-135-0x000002B9E4AC0000-0x000002B9E4AD0000-memory.dmp

        Filesize

        64KB

      • memory/1352-137-0x000002B9E4A10000-0x000002B9E4A20000-memory.dmp

        Filesize

        64KB

      • memory/1352-138-0x000002B9E4AD0000-0x000002B9E4AE0000-memory.dmp

        Filesize

        64KB

      • memory/1352-141-0x000002B9E4AE0000-0x000002B9E4AF0000-memory.dmp

        Filesize

        64KB

      • memory/1352-140-0x000002B9E4A00000-0x000002B9E4A10000-memory.dmp

        Filesize

        64KB

      • memory/1352-143-0x000002B9E2D40000-0x000002B9E2D41000-memory.dmp

        Filesize

        4KB

      • memory/1352-147-0x000002B9E4A20000-0x000002B9E4A30000-memory.dmp

        Filesize

        64KB

      • memory/1352-149-0x000002B9E4AF0000-0x000002B9E4B00000-memory.dmp

        Filesize

        64KB

      • memory/1352-148-0x000002B9E4A30000-0x000002B9E4A40000-memory.dmp

        Filesize

        64KB

      • memory/1352-152-0x000002B9E4B00000-0x000002B9E4B10000-memory.dmp

        Filesize

        64KB

      • memory/1352-151-0x000002B9E4A40000-0x000002B9E4A50000-memory.dmp

        Filesize

        64KB

      • memory/1352-154-0x000002B9E4A50000-0x000002B9E4A60000-memory.dmp

        Filesize

        64KB

      • memory/1352-155-0x000002B9E4B10000-0x000002B9E4B20000-memory.dmp

        Filesize

        64KB

      • memory/1352-157-0x000002B9E4A60000-0x000002B9E4A70000-memory.dmp

        Filesize

        64KB

      • memory/1352-158-0x000002B9E4B20000-0x000002B9E4B30000-memory.dmp

        Filesize

        64KB

      • memory/1352-161-0x000002B9E2D40000-0x000002B9E2D41000-memory.dmp

        Filesize

        4KB

      • memory/1352-166-0x000002B9E4B30000-0x000002B9E4B40000-memory.dmp

        Filesize

        64KB

      • memory/1352-165-0x000002B9E4A90000-0x000002B9E4AA0000-memory.dmp

        Filesize

        64KB

      • memory/1352-108-0x000002B9E4990000-0x000002B9E49A0000-memory.dmp

        Filesize

        64KB

      • memory/1352-163-0x000002B9E4A70000-0x000002B9E4A80000-memory.dmp

        Filesize

        64KB

      • memory/1352-169-0x000002B9E4AA0000-0x000002B9E4AB0000-memory.dmp

        Filesize

        64KB

      • memory/1352-170-0x000002B9E4B40000-0x000002B9E4B50000-memory.dmp

        Filesize

        64KB

      • memory/1352-171-0x000002B9E2D40000-0x000002B9E2D41000-memory.dmp

        Filesize

        4KB

      • memory/1352-174-0x000002B9E4AB0000-0x000002B9E4AC0000-memory.dmp

        Filesize

        64KB

      • memory/1352-177-0x000002B9E2D40000-0x000002B9E2D41000-memory.dmp

        Filesize

        4KB

      • memory/1352-179-0x000002B9E4AC0000-0x000002B9E4AD0000-memory.dmp

        Filesize

        64KB

      • memory/1352-180-0x000002B9E4AD0000-0x000002B9E4AE0000-memory.dmp

        Filesize

        64KB

      • memory/1352-16-0x000002B9E4860000-0x000002B9E4870000-memory.dmp

        Filesize

        64KB

      • memory/1352-110-0x000002B9E4A50000-0x000002B9E4A60000-memory.dmp

        Filesize

        64KB

      • memory/1352-185-0x000002B9E4B50000-0x000002B9E4B60000-memory.dmp

        Filesize

        64KB

      • memory/1352-189-0x000002B9E4860000-0x000002B9E4870000-memory.dmp

        Filesize

        64KB

      • memory/1352-188-0x000002B9E4850000-0x000002B9E4860000-memory.dmp

        Filesize

        64KB

      • memory/1352-187-0x000002B9E4990000-0x000002B9E49A0000-memory.dmp

        Filesize

        64KB

      • memory/1352-2-0x000002B9E45E0000-0x000002B9E4850000-memory.dmp

        Filesize

        2.4MB

      • memory/1352-11-0x000002B9E2D40000-0x000002B9E2D41000-memory.dmp

        Filesize

        4KB

      • memory/2448-249-0x000002CE26AE0000-0x000002CE26AE1000-memory.dmp

        Filesize

        4KB

      • memory/4036-345-0x000001A8F7AC0000-0x000001A8F7AC1000-memory.dmp

        Filesize

        4KB

      • memory/4036-378-0x000001A8F7AC0000-0x000001A8F7AC1000-memory.dmp

        Filesize

        4KB