strrat | 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb

General

Target

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
Size

480KB
MD5

aac338140e178a3cac423d3454cc7467
SHA1

a9c195e15b4109d4ece1309fb4e3b3bd77145421
SHA256

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb
SHA512

a96b2c8c985feccbc385a8ba1e7583be6913db7da15244b136c203f7ca320a03727425f3927c21157eae0c4da3fbbdd8fb71373655c6824544296ec66df834f2
SSDEEP

12288:PkQNy5kuH2lZ6r4os6WQMiyvtJMDiXxJfrJyru:XvuHTr4J7Qw1JJXxJ0ru

Score

10^/10

strrat discovery stealer trojan

Malware Config

Extracted

Family

strrat

C2

93.185.156.124:1912

127.0.0.1:1912

Attributes

license_id
khonsari
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
true
secondary_startup
true
startup
true

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2972	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	30
PID 2380 wrote to memory of 2972	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	30
PID 2380 wrote to memory of 2972	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	30
PID 2380 wrote to memory of 2972	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	30
PID 2380 wrote to memory of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31
PID 2380 wrote to memory of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31
PID 2380 wrote to memory of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31
PID 2380 wrote to memory of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31
PID 2380 wrote to memory of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31
PID 2380 wrote to memory of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31
PID 2380 wrote to memory of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31
PID 2380 wrote to memory of 2484	2380	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	31
PID 2484 wrote to memory of 2808	2484	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	32
PID 2484 wrote to memory of 2808	2484	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	32
PID 2484 wrote to memory of 2808	2484	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	32
PID 2484 wrote to memory of 2808	2484	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	32
PID 2808 wrote to memory of 2800	2808	cmd.exe	34
PID 2808 wrote to memory of 2800	2808	cmd.exe	34
PID 2808 wrote to memory of 2800	2808	cmd.exe	34
PID 2808 wrote to memory of 2800	2808	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
"C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
  "C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"
  2⤵
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
  "C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\A.jar"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\A.jar"
      4⤵
      PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A.jar

Filesize
92KB

MD5
105a14c6fce083e80f49b30db88ec915

SHA1
46187697a87562210e785917ce6ca16aeb4912b3

SHA256
7e5adae008afee158168b1943fcc41157c7de63ab4792cc5eba8d1830edd6d65

SHA512
2322eeeb100b644d53641ec3c1b0588579565636a2ea934924931f6f77b156b6d4e5925a2f36b0520e1f568d771860af53e9f3c39bb5238f7e7520389692c963

Download Submit
memory/2380-20-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-0-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/2380-3-0x0000000004970000-0x00000000049E4000-memory.dmp

Filesize
464KB

Download
memory/2380-4-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/2380-5-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/2380-6-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-7-0x0000000004F10000-0x0000000004F70000-memory.dmp

Filesize
384KB

Download
memory/2380-1-0x00000000000F0000-0x000000000016C000-memory.dmp

Filesize
496KB

Download
memory/2380-2-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2484-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2484-10-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2484-18-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2484-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2484-16-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2800-80-0x0000000074060000-0x0000000074839000-memory.dmp

Filesize
7.8MB

Download
memory/2800-84-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-61-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-71-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-76-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-48-0x0000000074060000-0x0000000074839000-memory.dmp

Filesize
7.8MB

Download
memory/2800-82-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-54-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-85-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-92-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-113-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-115-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-122-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-127-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2800-129-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing