Analysis
- max time kernel
146s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
27/09/2024, 12:49
General
- Target PO518464.js
- Size 458KB
- Sample240927-p2kmnawane
- SHA256 25c4220159b9f1acd768415b14403854a8dec47c3d1a1286e75631f60bc54ebf
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO518464.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\qousoree.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\qousoree.txt"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\qousoree.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\qousoree.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\qousoree.txt"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
jna6582979011540476116.dll
83aa4cc77f591dfc2374580bbd95f6ba_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0
qousoree.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1216-205-0x0000021948840000-0x0000021948841000-memory.dmp
memory/3128-106-0x000001BAD2650000-0x000001BAD2660000-memory.dmp
memory/3128-74-0x000001BAD2540000-0x000001BAD2550000-memory.dmp
memory/3128-22-0x000001BAD24D0000-0x000001BAD24E0000-memory.dmp
memory/3128-26-0x000001BAD24E0000-0x000001BAD24F0000-memory.dmp
memory/3128-28-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-29-0x000001BAD2500000-0x000001BAD2510000-memory.dmp
memory/3128-27-0x000001BAD24F0000-0x000001BAD2500000-memory.dmp
memory/3128-35-0x000001BAD2510000-0x000001BAD2520000-memory.dmp
memory/3128-39-0x000001BAD2220000-0x000001BAD2490000-memory.dmp
memory/3128-41-0x000001BAD2540000-0x000001BAD2550000-memory.dmp
memory/3128-43-0x000001BAD2490000-0x000001BAD24A0000-memory.dmp
memory/3128-42-0x000001BAD2530000-0x000001BAD2540000-memory.dmp
memory/3128-40-0x000001BAD2520000-0x000001BAD2530000-memory.dmp
memory/3128-45-0x000001BAD24A0000-0x000001BAD24B0000-memory.dmp
memory/3128-47-0x000001BAD2550000-0x000001BAD2560000-memory.dmp
memory/3128-49-0x000001BAD2560000-0x000001BAD2570000-memory.dmp
memory/3128-48-0x000001BAD24B0000-0x000001BAD24C0000-memory.dmp
memory/3128-55-0x000001BAD24D0000-0x000001BAD24E0000-memory.dmp
memory/3128-54-0x000001BAD2580000-0x000001BAD2590000-memory.dmp
memory/3128-53-0x000001BAD2570000-0x000001BAD2580000-memory.dmp
memory/3128-113-0x000001BAD2670000-0x000001BAD2680000-memory.dmp
memory/3128-58-0x000001BAD2590000-0x000001BAD25A0000-memory.dmp
memory/3128-57-0x000001BAD24E0000-0x000001BAD24F0000-memory.dmp
memory/3128-60-0x000001BAD24F0000-0x000001BAD2500000-memory.dmp
memory/3128-61-0x000001BAD25A0000-0x000001BAD25B0000-memory.dmp
memory/3128-64-0x000001BAD2500000-0x000001BAD2510000-memory.dmp
memory/3128-65-0x000001BAD25B0000-0x000001BAD25C0000-memory.dmp
memory/3128-69-0x000001BAD25C0000-0x000001BAD25D0000-memory.dmp
memory/3128-68-0x000001BAD2510000-0x000001BAD2520000-memory.dmp
memory/3128-70-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-71-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-108-0x000001BAD25B0000-0x000001BAD25C0000-memory.dmp
memory/3128-73-0x000001BAD2520000-0x000001BAD2530000-memory.dmp
memory/3128-75-0x000001BAD25D0000-0x000001BAD25E0000-memory.dmp
memory/3128-79-0x000001BAD25E0000-0x000001BAD25F0000-memory.dmp
memory/3128-78-0x000001BAD2530000-0x000001BAD2540000-memory.dmp
memory/3128-85-0x000001BAD2560000-0x000001BAD2570000-memory.dmp
memory/3128-84-0x000001BAD2600000-0x000001BAD2610000-memory.dmp
memory/3128-83-0x000001BAD25F0000-0x000001BAD2600000-memory.dmp
memory/3128-82-0x000001BAD2550000-0x000001BAD2560000-memory.dmp
memory/3128-90-0x000001BAD2580000-0x000001BAD2590000-memory.dmp
memory/3128-93-0x000001BAD2630000-0x000001BAD2640000-memory.dmp
memory/3128-92-0x000001BAD2620000-0x000001BAD2630000-memory.dmp
memory/3128-91-0x000001BAD2610000-0x000001BAD2620000-memory.dmp
memory/3128-109-0x000001BAD2660000-0x000001BAD2670000-memory.dmp
memory/3128-98-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-101-0x000001BAD2640000-0x000001BAD2650000-memory.dmp
memory/3128-100-0x000001BAD2590000-0x000001BAD25A0000-memory.dmp
memory/3128-102-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-18-0x000001BAD24B0000-0x000001BAD24C0000-memory.dmp
memory/3128-105-0x000001BAD25A0000-0x000001BAD25B0000-memory.dmp
memory/3128-107-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-89-0x000001BAD2570000-0x000001BAD2580000-memory.dmp
memory/3128-21-0x000001BAD24C0000-0x000001BAD24D0000-memory.dmp
memory/3128-52-0x000001BAD24C0000-0x000001BAD24D0000-memory.dmp
memory/3128-112-0x000001BAD25C0000-0x000001BAD25D0000-memory.dmp
memory/3128-115-0x000001BAD25D0000-0x000001BAD25E0000-memory.dmp
memory/3128-116-0x000001BAD2680000-0x000001BAD2690000-memory.dmp
memory/3128-118-0x000001BAD25E0000-0x000001BAD25F0000-memory.dmp
memory/3128-119-0x000001BAD2690000-0x000001BAD26A0000-memory.dmp
memory/3128-123-0x000001BAD26A0000-0x000001BAD26B0000-memory.dmp
memory/3128-122-0x000001BAD2600000-0x000001BAD2610000-memory.dmp
memory/3128-121-0x000001BAD25F0000-0x000001BAD2600000-memory.dmp
memory/3128-125-0x000001BAD26B0000-0x000001BAD26C0000-memory.dmp
memory/3128-127-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-135-0x000001BAD26C0000-0x000001BAD26D0000-memory.dmp
memory/3128-134-0x000001BAD2620000-0x000001BAD2630000-memory.dmp
memory/3128-133-0x000001BAD2610000-0x000001BAD2620000-memory.dmp
memory/3128-137-0x000001BAD2630000-0x000001BAD2640000-memory.dmp
memory/3128-138-0x000001BAD26D0000-0x000001BAD26E0000-memory.dmp
memory/3128-143-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-144-0x000001BAD2640000-0x000001BAD2650000-memory.dmp
memory/3128-146-0x000001BAD2650000-0x000001BAD2660000-memory.dmp
memory/3128-147-0x000001BAD2660000-0x000001BAD2670000-memory.dmp
memory/3128-149-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-150-0x000001BAD2200000-0x000001BAD2201000-memory.dmp
memory/3128-151-0x000001BAD2530000-0x000001BAD2540000-memory.dmp
memory/3128-160-0x000001BAD2510000-0x000001BAD2520000-memory.dmp
memory/3128-162-0x000001BAD2540000-0x000001BAD2550000-memory.dmp
memory/3128-177-0x000001BAD26B0000-0x000001BAD26C0000-memory.dmp
memory/3128-176-0x000001BAD26A0000-0x000001BAD26B0000-memory.dmp
memory/3128-175-0x000001BAD2690000-0x000001BAD26A0000-memory.dmp
memory/3128-174-0x000001BAD2680000-0x000001BAD2690000-memory.dmp
memory/3128-173-0x000001BAD2670000-0x000001BAD2680000-memory.dmp
memory/3128-172-0x000001BAD2570000-0x000001BAD2580000-memory.dmp
memory/3128-171-0x000001BAD2620000-0x000001BAD2630000-memory.dmp
memory/3128-170-0x000001BAD25E0000-0x000001BAD25F0000-memory.dmp
memory/3128-169-0x000001BAD25D0000-0x000001BAD25E0000-memory.dmp
memory/3128-168-0x000001BAD25A0000-0x000001BAD25B0000-memory.dmp
memory/3128-167-0x000001BAD2590000-0x000001BAD25A0000-memory.dmp
memory/3128-166-0x000001BAD2580000-0x000001BAD2590000-memory.dmp
memory/3128-165-0x000001BAD2560000-0x000001BAD2570000-memory.dmp
memory/3128-164-0x000001BAD2550000-0x000001BAD2560000-memory.dmp
memory/3128-163-0x000001BAD2220000-0x000001BAD2490000-memory.dmp
memory/3128-159-0x000001BAD2500000-0x000001BAD2510000-memory.dmp
memory/3128-158-0x000001BAD24F0000-0x000001BAD2500000-memory.dmp
memory/3128-157-0x000001BAD24E0000-0x000001BAD24F0000-memory.dmp
memory/3128-156-0x000001BAD24D0000-0x000001BAD24E0000-memory.dmp
memory/3128-17-0x000001BAD24A0000-0x000001BAD24B0000-memory.dmp
memory/3128-161-0x000001BAD2520000-0x000001BAD2530000-memory.dmp
memory/3128-155-0x000001BAD24C0000-0x000001BAD24D0000-memory.dmp
memory/3128-154-0x000001BAD24B0000-0x000001BAD24C0000-memory.dmp
memory/3128-153-0x000001BAD24A0000-0x000001BAD24B0000-memory.dmp
memory/3128-152-0x000001BAD2490000-0x000001BAD24A0000-memory.dmp
memory/3128-4-0x000001BAD2220000-0x000001BAD2490000-memory.dmp
memory/3128-14-0x000001BAD2490000-0x000001BAD24A0000-memory.dmp
memory/3964-245-0x0000022E800B0000-0x0000022E800B1000-memory.dmp
memory/3964-260-0x0000022E800B0000-0x0000022E800B1000-memory.dmp