strrat | a0dd28721c980f00fe5b3952447a5940db9fd2f9235f94a09f0741549f0c88e1

Reason

Machine shutdown

General

Target

4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
Size

84KB
MD5

ddaffd1e47777bd6ee6f1d89f80dbddb
SHA1

66c0dd7372365df8546b63d98f8c2c4eb0759429
SHA256

4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c
SHA512

3fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060
SSDEEP

1536:dVu6KIkej8xhZfQk7A0eSaNa650oIDZaQx2fCRMiMUTBEbY4dTe46gX+LFSnUhru:j2r1fH7A0dT6HFfCi

Score

10^/10

strrat persistence stealer trojan

Malware Config

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar\""	java.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2144	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1496	896	java.exe	89
PID 896 wrote to memory of 1496	896	java.exe	89
PID 896 wrote to memory of 1580	896	java.exe	91
PID 896 wrote to memory of 1580	896	java.exe	91
PID 1496 wrote to memory of 2144	1496	cmd.exe	93
PID 1496 wrote to memory of 2144	1496	cmd.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2144
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"
  2⤵
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar

Filesize
84KB

MD5
ddaffd1e47777bd6ee6f1d89f80dbddb

SHA1
66c0dd7372365df8546b63d98f8c2c4eb0759429

SHA256
4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c

SHA512
3fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
061ad14152c204e319e69ec90b9492d1

SHA1
90fbb6eac65fff6aab551d8a892bc5eda8858171

SHA256
272e8265f26a94e230467480201482f6ab2fb518eddafd2c1aecbf25e6c96299

SHA512
956da8b732589da204f6d9b50a16ce0bcc59ef5bebd52e08fc85452a89a2f4c57be9eeb4bce49ec1056e7ea5b877fbf8b58ae293f473f76d1b2f55637181cc66

Download Submit
memory/896-32-0x000002A3802E0000-0x000002A3802F0000-memory.dmp

Filesize
64KB

Download
memory/896-35-0x000002A380000000-0x000002A380270000-memory.dmp

Filesize
2.4MB

Download
memory/896-20-0x000002A3802B0000-0x000002A3802C0000-memory.dmp

Filesize
64KB

Download
memory/896-19-0x000002A3802A0000-0x000002A3802B0000-memory.dmp

Filesize
64KB

Download
memory/896-23-0x000002A3802C0000-0x000002A3802D0000-memory.dmp

Filesize
64KB

Download
memory/896-24-0x000002A3802D0000-0x000002A3802E0000-memory.dmp

Filesize
64KB

Download
memory/896-14-0x000002A380280000-0x000002A380290000-memory.dmp

Filesize
64KB

Download
memory/896-31-0x000002A3F9E10000-0x000002A3F9E11000-memory.dmp

Filesize
4KB

Download
memory/896-12-0x000002A380270000-0x000002A380280000-memory.dmp

Filesize
64KB

Download
memory/896-16-0x000002A380290000-0x000002A3802A0000-memory.dmp

Filesize
64KB

Download
memory/896-43-0x000002A3802E0000-0x000002A3802F0000-memory.dmp

Filesize
64KB

Download
memory/896-42-0x000002A3802D0000-0x000002A3802E0000-memory.dmp

Filesize
64KB

Download
memory/896-41-0x000002A3802C0000-0x000002A3802D0000-memory.dmp

Filesize
64KB

Download
memory/896-40-0x000002A3802B0000-0x000002A3802C0000-memory.dmp

Filesize
64KB

Download
memory/896-39-0x000002A3802A0000-0x000002A3802B0000-memory.dmp

Filesize
64KB

Download
memory/896-38-0x000002A380290000-0x000002A3802A0000-memory.dmp

Filesize
64KB

Download
memory/896-37-0x000002A380280000-0x000002A380290000-memory.dmp

Filesize
64KB

Download
memory/896-36-0x000002A380270000-0x000002A380280000-memory.dmp

Filesize
64KB

Download
memory/896-2-0x000002A380000000-0x000002A380270000-memory.dmp

Filesize
2.4MB

Download
memory/1580-47-0x0000019980000000-0x0000019980270000-memory.dmp

Filesize
2.4MB

Download
memory/1580-60-0x0000019980280000-0x0000019980290000-memory.dmp

Filesize
64KB

Download
memory/1580-59-0x0000019980270000-0x0000019980280000-memory.dmp

Filesize
64KB

Download
memory/1580-62-0x0000019980290000-0x00000199802A0000-memory.dmp

Filesize
64KB

Download
memory/1580-66-0x00000199802B0000-0x00000199802C0000-memory.dmp

Filesize
64KB

Download
memory/1580-65-0x00000199802A0000-0x00000199802B0000-memory.dmp

Filesize
64KB

Download
memory/1580-68-0x00000199802C0000-0x00000199802D0000-memory.dmp

Filesize
64KB

Download
memory/1580-72-0x00000199802E0000-0x00000199802F0000-memory.dmp

Filesize
64KB

Download
memory/1580-71-0x00000199802D0000-0x00000199802E0000-memory.dmp

Filesize
64KB

Download
memory/1580-74-0x00000199F9500000-0x00000199F9501000-memory.dmp

Filesize
4KB

Download
memory/1580-76-0x0000019980000000-0x0000019980270000-memory.dmp

Filesize
2.4MB

Download
memory/1580-77-0x0000019980270000-0x0000019980280000-memory.dmp

Filesize
64KB

Download
memory/1580-78-0x0000019980280000-0x0000019980290000-memory.dmp

Filesize
64KB

Download
memory/1580-80-0x0000019980290000-0x00000199802A0000-memory.dmp

Filesize
64KB

Download
memory/1580-81-0x00000199802A0000-0x00000199802B0000-memory.dmp

Filesize
64KB

Download
memory/1580-82-0x00000199802B0000-0x00000199802C0000-memory.dmp

Filesize
64KB

Download
memory/1580-83-0x00000199802C0000-0x00000199802D0000-memory.dmp

Filesize
64KB

Download
memory/1580-84-0x00000199802D0000-0x00000199802E0000-memory.dmp

Filesize
64KB

Download
memory/1580-85-0x00000199802E0000-0x00000199802F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads