Analysis
- max time kernel
136s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
28/09/2024, 01:31
General
- Target 7e97d5e7aa2412d71a076154766ddd78057bff909fc9a3469a38893459735642.js
- Size 201KB
- Sample240928-bxveeascrc
- SHA256 7e97d5e7aa2412d71a076154766ddd78057bff909fc9a3469a38893459735642
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\7e97d5e7aa2412d71a076154766ddd78057bff909fc9a3469a38893459735642.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dvyorhgb.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\dvyorhgb.txt"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\dvyorhgb.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\dvyorhgb.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\dvyorhgb.txt"4⤵
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
jna4733756732353813957.dll
83aa4cc77f591dfc2374580bbd95f6ba_03d68389-5a68-4d9e-92ac-47b927e624dd
dvyorhgb.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/3064-228-0x0000027CF2D70000-0x0000027CF2D71000-memory.dmp
memory/3064-213-0x0000027CF2D70000-0x0000027CF2D71000-memory.dmp
memory/3368-103-0x000001D32ECE0000-0x000001D32ECE1000-memory.dmp
memory/3368-167-0x000001D32EFB0000-0x000001D32EFC0000-memory.dmp
memory/3368-24-0x000001D32EFC0000-0x000001D32EFD0000-memory.dmp
memory/3368-27-0x000001D32EFD0000-0x000001D32EFE0000-memory.dmp
memory/3368-34-0x000001D32EFE0000-0x000001D32EFF0000-memory.dmp
memory/3368-35-0x000001D32EFF0000-0x000001D32F000000-memory.dmp
memory/3368-39-0x000001D32F010000-0x000001D32F020000-memory.dmp
memory/3368-41-0x000001D32EF70000-0x000001D32EF80000-memory.dmp
memory/3368-43-0x000001D32EF80000-0x000001D32EF90000-memory.dmp
memory/3368-44-0x000001D32F020000-0x000001D32F030000-memory.dmp
memory/3368-38-0x000001D32F000000-0x000001D32F010000-memory.dmp
memory/3368-51-0x000001D32EFA0000-0x000001D32EFB0000-memory.dmp
memory/3368-50-0x000001D32F040000-0x000001D32F050000-memory.dmp
memory/3368-49-0x000001D32F030000-0x000001D32F040000-memory.dmp
memory/3368-48-0x000001D32EF90000-0x000001D32EFA0000-memory.dmp
memory/3368-46-0x000001D32ECE0000-0x000001D32ECE1000-memory.dmp
memory/3368-37-0x000001D32ED00000-0x000001D32EF70000-memory.dmp
memory/3368-56-0x000001D32EFC0000-0x000001D32EFD0000-memory.dmp
memory/3368-62-0x000001D32F080000-0x000001D32F090000-memory.dmp
memory/3368-61-0x000001D32F070000-0x000001D32F080000-memory.dmp
memory/3368-60-0x000001D32EFE0000-0x000001D32EFF0000-memory.dmp
memory/3368-59-0x000001D32EFD0000-0x000001D32EFE0000-memory.dmp
memory/3368-55-0x000001D32F060000-0x000001D32F070000-memory.dmp
memory/3368-54-0x000001D32F050000-0x000001D32F060000-memory.dmp
memory/3368-53-0x000001D32EFB0000-0x000001D32EFC0000-memory.dmp
memory/3368-67-0x000001D32F090000-0x000001D32F0A0000-memory.dmp
memory/3368-66-0x000001D32EFF0000-0x000001D32F000000-memory.dmp
memory/3368-72-0x000001D32F000000-0x000001D32F010000-memory.dmp
memory/3368-74-0x000001D32F0A0000-0x000001D32F0B0000-memory.dmp
memory/3368-73-0x000001D32F010000-0x000001D32F020000-memory.dmp
memory/3368-76-0x000001D32F0B0000-0x000001D32F0C0000-memory.dmp
memory/3368-80-0x000001D32F020000-0x000001D32F030000-memory.dmp
memory/3368-86-0x000001D32F040000-0x000001D32F050000-memory.dmp
memory/3368-90-0x000001D32F050000-0x000001D32F060000-memory.dmp
memory/3368-89-0x000001D32F100000-0x000001D32F110000-memory.dmp
memory/3368-88-0x000001D32F0F0000-0x000001D32F100000-memory.dmp
memory/3368-85-0x000001D32F030000-0x000001D32F040000-memory.dmp
memory/3368-84-0x000001D32F0E0000-0x000001D32F0F0000-memory.dmp
memory/3368-83-0x000001D32F0D0000-0x000001D32F0E0000-memory.dmp
memory/3368-82-0x000001D32F0C0000-0x000001D32F0D0000-memory.dmp
memory/3368-96-0x000001D32ECE0000-0x000001D32ECE1000-memory.dmp
memory/3368-98-0x000001D32F110000-0x000001D32F120000-memory.dmp
memory/3368-97-0x000001D32F060000-0x000001D32F070000-memory.dmp
memory/3368-100-0x000001D32F070000-0x000001D32F080000-memory.dmp
memory/3368-102-0x000001D32F120000-0x000001D32F130000-memory.dmp
memory/3368-101-0x000001D32F080000-0x000001D32F090000-memory.dmp
memory/3368-20-0x000001D32EFA0000-0x000001D32EFB0000-memory.dmp
memory/3368-106-0x000001D32F130000-0x000001D32F140000-memory.dmp
memory/3368-110-0x000001D32F090000-0x000001D32F0A0000-memory.dmp
memory/3368-111-0x000001D32F140000-0x000001D32F150000-memory.dmp
memory/3368-22-0x000001D32EFB0000-0x000001D32EFC0000-memory.dmp
memory/3368-113-0x000001D32F150000-0x000001D32F160000-memory.dmp
memory/3368-166-0x000001D32F050000-0x000001D32F060000-memory.dmp
memory/3368-120-0x000001D32F0E0000-0x000001D32F0F0000-memory.dmp
memory/3368-124-0x000001D32F100000-0x000001D32F110000-memory.dmp
memory/3368-123-0x000001D32F0F0000-0x000001D32F100000-memory.dmp
memory/3368-122-0x000001D32F170000-0x000001D32F180000-memory.dmp
memory/3368-119-0x000001D32F0D0000-0x000001D32F0E0000-memory.dmp
memory/3368-118-0x000001D32F0C0000-0x000001D32F0D0000-memory.dmp
memory/3368-117-0x000001D32F160000-0x000001D32F170000-memory.dmp
memory/3368-121-0x000001D32F160000-0x000001D32F170000-memory.dmp
memory/3368-125-0x000001D32ECE0000-0x000001D32ECE1000-memory.dmp
memory/3368-130-0x000001D32F180000-0x000001D32F190000-memory.dmp
memory/3368-133-0x000001D32F190000-0x000001D32F1A0000-memory.dmp
memory/3368-132-0x000001D32F110000-0x000001D32F120000-memory.dmp
memory/3368-137-0x000001D32F120000-0x000001D32F130000-memory.dmp
memory/3368-138-0x000001D32F1A0000-0x000001D32F1B0000-memory.dmp
memory/3368-143-0x000001D32ECE0000-0x000001D32ECE1000-memory.dmp
memory/3368-144-0x000001D32F130000-0x000001D32F140000-memory.dmp
memory/3368-146-0x000001D32F140000-0x000001D32F150000-memory.dmp
memory/3368-147-0x000001D32F150000-0x000001D32F160000-memory.dmp
memory/3368-150-0x000001D32ECE0000-0x000001D32ECE1000-memory.dmp
memory/3368-153-0x000001D32EF80000-0x000001D32EF90000-memory.dmp
memory/3368-152-0x000001D32EF70000-0x000001D32EF80000-memory.dmp
memory/3368-151-0x000001D32ED00000-0x000001D32EF70000-memory.dmp
memory/3368-154-0x000001D32EF90000-0x000001D32EFA0000-memory.dmp
memory/3368-160-0x000001D32EFE0000-0x000001D32EFF0000-memory.dmp
memory/3368-177-0x000001D32F170000-0x000001D32F180000-memory.dmp
memory/3368-176-0x000001D32F160000-0x000001D32F170000-memory.dmp
memory/3368-175-0x000001D32F120000-0x000001D32F130000-memory.dmp
memory/3368-173-0x000001D32F110000-0x000001D32F120000-memory.dmp
memory/3368-172-0x000001D32F0D0000-0x000001D32F0E0000-memory.dmp
memory/3368-171-0x000001D32F0B0000-0x000001D32F0C0000-memory.dmp
memory/3368-170-0x000001D32F090000-0x000001D32F0A0000-memory.dmp
memory/3368-169-0x000001D32F080000-0x000001D32F090000-memory.dmp
memory/3368-168-0x000001D32F070000-0x000001D32F080000-memory.dmp
memory/3368-112-0x000001D32F0A0000-0x000001D32F0B0000-memory.dmp
memory/3368-116-0x000001D32F0B0000-0x000001D32F0C0000-memory.dmp
memory/3368-165-0x000001D32F040000-0x000001D32F050000-memory.dmp
memory/3368-164-0x000001D32F030000-0x000001D32F040000-memory.dmp
memory/3368-163-0x000001D32F020000-0x000001D32F030000-memory.dmp
memory/3368-162-0x000001D32F010000-0x000001D32F020000-memory.dmp
memory/3368-161-0x000001D32F000000-0x000001D32F010000-memory.dmp
memory/3368-18-0x000001D32EF90000-0x000001D32EFA0000-memory.dmp
memory/3368-16-0x000001D32EF80000-0x000001D32EF90000-memory.dmp
memory/3368-14-0x000001D32EF70000-0x000001D32EF80000-memory.dmp
memory/3368-4-0x000001D32ED00000-0x000001D32EF70000-memory.dmp
memory/3368-159-0x000001D32EFF0000-0x000001D32F000000-memory.dmp
memory/3368-158-0x000001D32EFD0000-0x000001D32EFE0000-memory.dmp
memory/3368-157-0x000001D32EFC0000-0x000001D32EFD0000-memory.dmp
memory/3368-156-0x000001D32F060000-0x000001D32F070000-memory.dmp
memory/3368-155-0x000001D32EFA0000-0x000001D32EFB0000-memory.dmp
memory/4688-262-0x0000029104A20000-0x0000029104A21000-memory.dmp