Analysis
- max time kernel
145s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
03/10/2024, 07:13
General
- Target Quotation#4873920.js
- Size 207KB
- Sample241003-h14kta1cmp
- SHA256 cb19162767f15a3043137f8124c6df663861b6537b28cfe7d930fd18cec33c6b
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Quotation#4873920.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\rswbaat.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\rswbaat.txt"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\rswbaat.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\rswbaat.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\rswbaat.txt"4⤵
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
jna173773971250905061.dll
83aa4cc77f591dfc2374580bbd95f6ba_acd03e19-89e2-40d7-b0f4-25b8a05635ee
rswbaat.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/540-260-0x0000018DE8350000-0x0000018DE8351000-memory.dmp
memory/1256-232-0x0000022EBC160000-0x0000022EBC161000-memory.dmp
memory/1256-208-0x0000022EBC160000-0x0000022EBC161000-memory.dmp
memory/2400-105-0x00000263E0F70000-0x00000263E0F71000-memory.dmp
memory/2400-53-0x00000263E1240000-0x00000263E1250000-memory.dmp
memory/2400-27-0x00000263E1260000-0x00000263E1270000-memory.dmp
memory/2400-30-0x00000263E1280000-0x00000263E1290000-memory.dmp
memory/2400-37-0x00000263E1290000-0x00000263E12A0000-memory.dmp
memory/2400-36-0x00000263E0F90000-0x00000263E1200000-memory.dmp
memory/2400-38-0x00000263E0F70000-0x00000263E0F71000-memory.dmp
memory/2400-41-0x00000263E12A0000-0x00000263E12B0000-memory.dmp
memory/2400-40-0x00000263E1200000-0x00000263E1210000-memory.dmp
memory/2400-44-0x00000263E12B0000-0x00000263E12C0000-memory.dmp
memory/2400-43-0x00000263E1210000-0x00000263E1220000-memory.dmp
memory/2400-47-0x00000263E12C0000-0x00000263E12D0000-memory.dmp
memory/2400-46-0x00000263E1220000-0x00000263E1230000-memory.dmp
memory/2400-50-0x00000263E12D0000-0x00000263E12E0000-memory.dmp
memory/2400-49-0x00000263E1230000-0x00000263E1240000-memory.dmp
memory/2400-55-0x00000263E12E0000-0x00000263E12F0000-memory.dmp
memory/2400-54-0x00000263E1250000-0x00000263E1260000-memory.dmp
memory/2400-60-0x00000263E1270000-0x00000263E1280000-memory.dmp
memory/2400-59-0x00000263E1260000-0x00000263E1270000-memory.dmp
memory/2400-58-0x00000263E1300000-0x00000263E1310000-memory.dmp
memory/2400-57-0x00000263E12F0000-0x00000263E1300000-memory.dmp
memory/2400-109-0x00000263E1320000-0x00000263E1330000-memory.dmp
memory/2400-62-0x00000263E1310000-0x00000263E1320000-memory.dmp
memory/2400-67-0x00000263E1320000-0x00000263E1330000-memory.dmp
memory/2400-66-0x00000263E1280000-0x00000263E1290000-memory.dmp
memory/2400-115-0x00000263E1340000-0x00000263E1350000-memory.dmp
memory/2400-71-0x00000263E1330000-0x00000263E1340000-memory.dmp
memory/2400-70-0x00000263E1290000-0x00000263E12A0000-memory.dmp
memory/2400-76-0x00000263E12A0000-0x00000263E12B0000-memory.dmp
memory/2400-77-0x00000263E1340000-0x00000263E1350000-memory.dmp
memory/2400-80-0x00000263E1350000-0x00000263E1360000-memory.dmp
memory/2400-79-0x00000263E12B0000-0x00000263E12C0000-memory.dmp
memory/2400-82-0x00000263E1360000-0x00000263E1370000-memory.dmp
memory/2400-81-0x00000263E12C0000-0x00000263E12D0000-memory.dmp
memory/2400-85-0x00000263E1370000-0x00000263E1380000-memory.dmp
memory/2400-84-0x00000263E12D0000-0x00000263E12E0000-memory.dmp
memory/2400-90-0x00000263E1380000-0x00000263E1390000-memory.dmp
memory/2400-94-0x00000263E1300000-0x00000263E1310000-memory.dmp
memory/2400-93-0x00000263E12F0000-0x00000263E1300000-memory.dmp
memory/2400-92-0x00000263E13A0000-0x00000263E13B0000-memory.dmp
memory/2400-110-0x00000263E13D0000-0x00000263E13E0000-memory.dmp
memory/2400-89-0x00000263E12E0000-0x00000263E12F0000-memory.dmp
memory/2400-99-0x00000263E0F70000-0x00000263E0F71000-memory.dmp
memory/2400-101-0x00000263E13B0000-0x00000263E13C0000-memory.dmp
memory/2400-104-0x00000263E13C0000-0x00000263E13D0000-memory.dmp
memory/2400-103-0x00000263E1310000-0x00000263E1320000-memory.dmp
memory/2400-23-0x00000263E1240000-0x00000263E1250000-memory.dmp
memory/2400-107-0x00000263E0F70000-0x00000263E0F71000-memory.dmp
memory/2400-112-0x00000263E13E0000-0x00000263E13F0000-memory.dmp
memory/2400-111-0x00000263E1330000-0x00000263E1340000-memory.dmp
memory/2400-91-0x00000263E1390000-0x00000263E13A0000-memory.dmp
memory/2400-28-0x00000263E1270000-0x00000263E1280000-memory.dmp
memory/2400-68-0x00000263E0F70000-0x00000263E0F71000-memory.dmp
memory/2400-116-0x00000263E13F0000-0x00000263E1400000-memory.dmp
memory/2400-119-0x00000263E1400000-0x00000263E1410000-memory.dmp
memory/2400-118-0x00000263E1350000-0x00000263E1360000-memory.dmp
memory/2400-123-0x00000263E1410000-0x00000263E1420000-memory.dmp
memory/2400-122-0x00000263E1370000-0x00000263E1380000-memory.dmp
memory/2400-121-0x00000263E1360000-0x00000263E1370000-memory.dmp
memory/2400-125-0x00000263E0F70000-0x00000263E0F71000-memory.dmp
memory/2400-134-0x00000263E13A0000-0x00000263E13B0000-memory.dmp
memory/2400-133-0x00000263E1390000-0x00000263E13A0000-memory.dmp
memory/2400-132-0x00000263E1380000-0x00000263E1390000-memory.dmp
memory/2400-131-0x00000263E1430000-0x00000263E1440000-memory.dmp
memory/2400-130-0x00000263E1420000-0x00000263E1430000-memory.dmp
memory/2400-137-0x00000263E1440000-0x00000263E1450000-memory.dmp
memory/2400-141-0x00000263E0F70000-0x00000263E0F71000-memory.dmp
memory/2400-144-0x00000263E13B0000-0x00000263E13C0000-memory.dmp
memory/2400-146-0x00000263E13C0000-0x00000263E13D0000-memory.dmp
memory/2400-147-0x00000263E13D0000-0x00000263E13E0000-memory.dmp
memory/2400-150-0x00000263E0F70000-0x00000263E0F71000-memory.dmp
memory/2400-169-0x00000263E1310000-0x00000263E1320000-memory.dmp
memory/2400-177-0x00000263E1410000-0x00000263E1420000-memory.dmp
memory/2400-176-0x00000263E1400000-0x00000263E1410000-memory.dmp
memory/2400-175-0x00000263E13F0000-0x00000263E1400000-memory.dmp
memory/2400-174-0x00000263E13A0000-0x00000263E13B0000-memory.dmp
memory/2400-173-0x00000263E13E0000-0x00000263E13F0000-memory.dmp
memory/2400-172-0x00000263E1340000-0x00000263E1350000-memory.dmp
memory/2400-171-0x00000263E1330000-0x00000263E1340000-memory.dmp
memory/2400-170-0x00000263E1320000-0x00000263E1330000-memory.dmp
memory/2400-168-0x00000263E1300000-0x00000263E1310000-memory.dmp
memory/2400-167-0x00000263E12F0000-0x00000263E1300000-memory.dmp
memory/2400-166-0x00000263E12E0000-0x00000263E12F0000-memory.dmp
memory/2400-165-0x00000263E12D0000-0x00000263E12E0000-memory.dmp
memory/2400-164-0x00000263E12C0000-0x00000263E12D0000-memory.dmp
memory/2400-163-0x00000263E12B0000-0x00000263E12C0000-memory.dmp
memory/2400-162-0x00000263E12A0000-0x00000263E12B0000-memory.dmp
memory/2400-161-0x00000263E1290000-0x00000263E12A0000-memory.dmp
memory/2400-160-0x00000263E1280000-0x00000263E1290000-memory.dmp
memory/2400-159-0x00000263E1270000-0x00000263E1280000-memory.dmp
memory/2400-158-0x00000263E1260000-0x00000263E1270000-memory.dmp
memory/2400-157-0x00000263E1250000-0x00000263E1260000-memory.dmp
memory/2400-156-0x00000263E1240000-0x00000263E1250000-memory.dmp
memory/2400-155-0x00000263E1230000-0x00000263E1240000-memory.dmp
memory/2400-154-0x00000263E1220000-0x00000263E1230000-memory.dmp
memory/2400-153-0x00000263E1210000-0x00000263E1220000-memory.dmp
memory/2400-152-0x00000263E1200000-0x00000263E1210000-memory.dmp
memory/2400-151-0x00000263E0F90000-0x00000263E1200000-memory.dmp
memory/2400-24-0x00000263E1250000-0x00000263E1260000-memory.dmp
memory/2400-20-0x00000263E1230000-0x00000263E1240000-memory.dmp
memory/2400-18-0x00000263E1220000-0x00000263E1230000-memory.dmp
memory/2400-16-0x00000263E1210000-0x00000263E1220000-memory.dmp
memory/2400-14-0x00000263E1200000-0x00000263E1210000-memory.dmp
memory/2400-4-0x00000263E0F90000-0x00000263E1200000-memory.dmp