Analysis
- max time kernel
145s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/08/2024, 02:24
General
- Target c3b27ba76af8fec666012c88a8c7a72a428315d8d475b7cf8a4e2e2b6e8b20cf.jar
- Size 400KB
- Sample240822-cv2w5stfld
- SHA256 c3b27ba76af8fec666012c88a8c7a72a428315d8d475b7cf8a4e2e2b6e8b20cf
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\c3b27ba76af8fec666012c88a8c7a72a428315d8d475b7cf8a4e2e2b6e8b20cf.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\c3b27ba76af8fec666012c88a8c7a72a428315d8d475b7cf8a4e2e2b6e8b20cf.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\c3b27ba76af8fec666012c88a8c7a72a428315d8d475b7cf8a4e2e2b6e8b20cf.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\c3b27ba76af8fec666012c88a8c7a72a428315d8d475b7cf8a4e2e2b6e8b20cf.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\c3b27ba76af8fec666012c88a8c7a72a428315d8d475b7cf8a4e2e2b6e8b20cf.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
jna2980732467585183811.dll
83aa4cc77f591dfc2374580bbd95f6ba_32404286-a0b5-4a93-9620-6f13fd83251a
c3b27ba76af8fec666012c88a8c7a72a428315d8d475b7cf8a4e2e2b6e8b20cf.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1060-393-0x0000027E979B0000-0x0000027E979B1000-memory.dmp
memory/1060-359-0x0000027E979B0000-0x0000027E979B1000-memory.dmp
memory/5048-101-0x0000020F50DD0000-0x0000020F50DE0000-memory.dmp
memory/5048-69-0x0000020F50D30000-0x0000020F50D40000-memory.dmp
memory/5048-117-0x0000020F50E10000-0x0000020F50E20000-memory.dmp
memory/5048-26-0x0000020F50D00000-0x0000020F50D10000-memory.dmp
memory/5048-27-0x0000020F50D10000-0x0000020F50D20000-memory.dmp
memory/5048-32-0x0000020F50D30000-0x0000020F50D40000-memory.dmp
memory/5048-31-0x0000020F50D20000-0x0000020F50D30000-memory.dmp
memory/5048-30-0x0000020F50A30000-0x0000020F50CA0000-memory.dmp
memory/5048-36-0x0000020F50D40000-0x0000020F50D50000-memory.dmp
memory/5048-35-0x0000020F50CA0000-0x0000020F50CB0000-memory.dmp
memory/5048-39-0x0000020F50D50000-0x0000020F50D60000-memory.dmp
memory/5048-38-0x0000020F50CB0000-0x0000020F50CC0000-memory.dmp
memory/5048-44-0x0000020F50D60000-0x0000020F50D70000-memory.dmp
memory/5048-48-0x0000020F50CD0000-0x0000020F50CE0000-memory.dmp
memory/5048-47-0x0000020F50D90000-0x0000020F50DA0000-memory.dmp
memory/5048-46-0x0000020F50D80000-0x0000020F50D90000-memory.dmp
memory/5048-45-0x0000020F50D70000-0x0000020F50D80000-memory.dmp
memory/5048-43-0x0000020F50CC0000-0x0000020F50CD0000-memory.dmp
memory/5048-50-0x0000020F50CE0000-0x0000020F50CF0000-memory.dmp
memory/5048-51-0x0000020F50DA0000-0x0000020F50DB0000-memory.dmp
memory/5048-57-0x0000020F50CF0000-0x0000020F50D00000-memory.dmp
memory/5048-58-0x0000020F50DB0000-0x0000020F50DC0000-memory.dmp
memory/5048-60-0x0000020F50D00000-0x0000020F50D10000-memory.dmp
memory/5048-62-0x0000020F50D10000-0x0000020F50D20000-memory.dmp
memory/5048-63-0x0000020F50DC0000-0x0000020F50DD0000-memory.dmp
memory/5048-61-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5048-65-0x0000020F50DD0000-0x0000020F50DE0000-memory.dmp
memory/5048-68-0x0000020F50D20000-0x0000020F50D30000-memory.dmp
memory/5048-71-0x0000020F50DF0000-0x0000020F50E00000-memory.dmp
memory/5048-70-0x0000020F50DE0000-0x0000020F50DF0000-memory.dmp
memory/5048-113-0x0000020F50E00000-0x0000020F50E10000-memory.dmp
memory/5048-77-0x0000020F50D50000-0x0000020F50D60000-memory.dmp
memory/5048-84-0x0000020F50E20000-0x0000020F50E30000-memory.dmp
memory/5048-83-0x0000020F50D90000-0x0000020F50DA0000-memory.dmp
memory/5048-82-0x0000020F50D80000-0x0000020F50D90000-memory.dmp
memory/5048-85-0x0000020F50E30000-0x0000020F50E40000-memory.dmp
memory/5048-81-0x0000020F50D70000-0x0000020F50D80000-memory.dmp
memory/5048-80-0x0000020F50D60000-0x0000020F50D70000-memory.dmp
memory/5048-76-0x0000020F50E10000-0x0000020F50E20000-memory.dmp
memory/5048-75-0x0000020F50E00000-0x0000020F50E10000-memory.dmp
memory/5048-74-0x0000020F50D40000-0x0000020F50D50000-memory.dmp
memory/5048-90-0x0000020F50E40000-0x0000020F50E50000-memory.dmp
memory/5048-108-0x0000020F50E90000-0x0000020F50EA0000-memory.dmp
memory/5048-93-0x0000020F50E50000-0x0000020F50E60000-memory.dmp
memory/5048-92-0x0000020F50DB0000-0x0000020F50DC0000-memory.dmp
memory/5048-99-0x0000020F50E60000-0x0000020F50E70000-memory.dmp
memory/5048-97-0x0000020F50DC0000-0x0000020F50DD0000-memory.dmp
memory/5048-102-0x0000020F50E70000-0x0000020F50E80000-memory.dmp
memory/5048-19-0x0000020F50CD0000-0x0000020F50CE0000-memory.dmp
memory/5048-104-0x0000020F50DE0000-0x0000020F50DF0000-memory.dmp
memory/5048-105-0x0000020F50E80000-0x0000020F50E90000-memory.dmp
memory/5048-107-0x0000020F50DF0000-0x0000020F50E00000-memory.dmp
memory/5048-89-0x0000020F50DA0000-0x0000020F50DB0000-memory.dmp
memory/5048-21-0x0000020F50CE0000-0x0000020F50CF0000-memory.dmp
memory/5048-23-0x0000020F50CF0000-0x0000020F50D00000-memory.dmp
memory/5048-116-0x0000020F50EC0000-0x0000020F50ED0000-memory.dmp
memory/5048-115-0x0000020F50EB0000-0x0000020F50EC0000-memory.dmp
memory/5048-114-0x0000020F50EA0000-0x0000020F50EB0000-memory.dmp
memory/5048-121-0x0000020F50ED0000-0x0000020F50EE0000-memory.dmp
memory/5048-120-0x0000020F50E20000-0x0000020F50E30000-memory.dmp
memory/5048-124-0x0000020F50EE0000-0x0000020F50EF0000-memory.dmp
memory/5048-123-0x0000020F50E30000-0x0000020F50E40000-memory.dmp
memory/5048-126-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5048-128-0x0000020F50E40000-0x0000020F50E50000-memory.dmp
memory/5048-129-0x0000020F50EF0000-0x0000020F50F00000-memory.dmp
memory/5048-131-0x0000020F50E50000-0x0000020F50E60000-memory.dmp
memory/5048-132-0x0000020F50F00000-0x0000020F50F10000-memory.dmp
memory/5048-136-0x0000020F50F10000-0x0000020F50F20000-memory.dmp
memory/5048-135-0x0000020F50E60000-0x0000020F50E70000-memory.dmp
memory/5048-139-0x0000020F50F20000-0x0000020F50F30000-memory.dmp
memory/5048-138-0x0000020F50E70000-0x0000020F50E80000-memory.dmp
memory/5048-142-0x0000020F50E80000-0x0000020F50E90000-memory.dmp
memory/5048-143-0x0000020F50F30000-0x0000020F50F40000-memory.dmp
memory/5048-145-0x0000020F50E90000-0x0000020F50EA0000-memory.dmp
memory/5048-146-0x0000020F50F40000-0x0000020F50F50000-memory.dmp
memory/5048-147-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5048-149-0x0000020F50EA0000-0x0000020F50EB0000-memory.dmp
memory/5048-152-0x0000020F50F50000-0x0000020F50F60000-memory.dmp
memory/5048-151-0x0000020F50EC0000-0x0000020F50ED0000-memory.dmp
memory/5048-150-0x0000020F50EB0000-0x0000020F50EC0000-memory.dmp
memory/5048-154-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5048-157-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5048-160-0x0000020F50F60000-0x0000020F50F70000-memory.dmp
memory/5048-159-0x0000020F50ED0000-0x0000020F50EE0000-memory.dmp
memory/5048-162-0x0000020F50EE0000-0x0000020F50EF0000-memory.dmp
memory/5048-164-0x0000020F50EF0000-0x0000020F50F00000-memory.dmp
memory/5048-165-0x0000020F50F70000-0x0000020F50F80000-memory.dmp
memory/5048-166-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5048-167-0x0000020F50F00000-0x0000020F50F10000-memory.dmp
memory/5048-168-0x0000020F50F10000-0x0000020F50F20000-memory.dmp
memory/5048-169-0x0000020F50F20000-0x0000020F50F30000-memory.dmp
memory/5048-170-0x0000020F50F30000-0x0000020F50F40000-memory.dmp
memory/5048-171-0x0000020F50F40000-0x0000020F50F50000-memory.dmp
memory/5048-173-0x0000020F50F50000-0x0000020F50F60000-memory.dmp
memory/5048-174-0x0000020F50F80000-0x0000020F50F90000-memory.dmp
memory/5048-17-0x0000020F50CC0000-0x0000020F50CD0000-memory.dmp
memory/5048-178-0x0000020F50F60000-0x0000020F50F70000-memory.dmp
memory/5048-180-0x0000020F50F70000-0x0000020F50F80000-memory.dmp
memory/5048-188-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5048-190-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5048-191-0x0000020F50CB0000-0x0000020F50CC0000-memory.dmp
memory/5048-2-0x0000020F50A30000-0x0000020F50CA0000-memory.dmp
memory/5048-14-0x0000020F50CA0000-0x0000020F50CB0000-memory.dmp
memory/5048-15-0x0000020F50CB0000-0x0000020F50CC0000-memory.dmp
memory/5048-11-0x0000020F4F1D0000-0x0000020F4F1D1000-memory.dmp
memory/5100-253-0x000001F9CC560000-0x000001F9CC561000-memory.dmp