Analysis
- max time kernel
31s - max time network
39s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
31/08/2024, 01:54
Errors
General
- Target 4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
- Size 84KB
- Sample240831-cbpgpszbrq
- SHA256 4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
3903daac9bc4a3b7.timestamp
memory/896-32-0x000002A3802E0000-0x000002A3802F0000-memory.dmp
memory/896-35-0x000002A380000000-0x000002A380270000-memory.dmp
memory/896-20-0x000002A3802B0000-0x000002A3802C0000-memory.dmp
memory/896-19-0x000002A3802A0000-0x000002A3802B0000-memory.dmp
memory/896-23-0x000002A3802C0000-0x000002A3802D0000-memory.dmp
memory/896-24-0x000002A3802D0000-0x000002A3802E0000-memory.dmp
memory/896-14-0x000002A380280000-0x000002A380290000-memory.dmp
memory/896-31-0x000002A3F9E10000-0x000002A3F9E11000-memory.dmp
memory/896-12-0x000002A380270000-0x000002A380280000-memory.dmp
memory/896-16-0x000002A380290000-0x000002A3802A0000-memory.dmp
memory/896-43-0x000002A3802E0000-0x000002A3802F0000-memory.dmp
memory/896-42-0x000002A3802D0000-0x000002A3802E0000-memory.dmp
memory/896-41-0x000002A3802C0000-0x000002A3802D0000-memory.dmp
memory/896-40-0x000002A3802B0000-0x000002A3802C0000-memory.dmp
memory/896-39-0x000002A3802A0000-0x000002A3802B0000-memory.dmp
memory/896-38-0x000002A380290000-0x000002A3802A0000-memory.dmp
memory/896-37-0x000002A380280000-0x000002A380290000-memory.dmp
memory/896-36-0x000002A380270000-0x000002A380280000-memory.dmp
memory/896-2-0x000002A380000000-0x000002A380270000-memory.dmp
memory/1580-47-0x0000019980000000-0x0000019980270000-memory.dmp
memory/1580-60-0x0000019980280000-0x0000019980290000-memory.dmp
memory/1580-59-0x0000019980270000-0x0000019980280000-memory.dmp
memory/1580-62-0x0000019980290000-0x00000199802A0000-memory.dmp
memory/1580-66-0x00000199802B0000-0x00000199802C0000-memory.dmp
memory/1580-65-0x00000199802A0000-0x00000199802B0000-memory.dmp
memory/1580-68-0x00000199802C0000-0x00000199802D0000-memory.dmp
memory/1580-72-0x00000199802E0000-0x00000199802F0000-memory.dmp
memory/1580-71-0x00000199802D0000-0x00000199802E0000-memory.dmp
memory/1580-74-0x00000199F9500000-0x00000199F9501000-memory.dmp
memory/1580-76-0x0000019980000000-0x0000019980270000-memory.dmp
memory/1580-77-0x0000019980270000-0x0000019980280000-memory.dmp
memory/1580-78-0x0000019980280000-0x0000019980290000-memory.dmp
memory/1580-80-0x0000019980290000-0x00000199802A0000-memory.dmp
memory/1580-81-0x00000199802A0000-0x00000199802B0000-memory.dmp
memory/1580-82-0x00000199802B0000-0x00000199802C0000-memory.dmp
memory/1580-83-0x00000199802C0000-0x00000199802D0000-memory.dmp
memory/1580-84-0x00000199802D0000-0x00000199802E0000-memory.dmp
memory/1580-85-0x00000199802E0000-0x00000199802F0000-memory.dmp