Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
04/10/2024, 10:00
General
- Target URGENT PAYMENT REQUEST.js
- Size 455KB
- Sample241004-l1sebssbma
- SHA256 b5fab9889d333c721fed265c13879f11315afe346d13356d4d1d61d16cc2b9d7
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\URGENT PAYMENT REQUEST.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\kxcdfoeund.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\kxcdfoeund.txt"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\kxcdfoeund.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\kxcdfoeund.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\kxcdfoeund.txt"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna5086997063020587849.dll
83aa4cc77f591dfc2374580bbd95f6ba_03d68389-5a68-4d9e-92ac-47b927e624dd
kxcdfoeund.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/964-257-0x000001DAA97E0000-0x000001DAA97E1000-memory.dmp
memory/964-249-0x000001DAA97E0000-0x000001DAA97E1000-memory.dmp
memory/2160-214-0x00000172FBDE0000-0x00000172FBDE1000-memory.dmp
memory/4836-62-0x00000209340F0000-0x0000020934100000-memory.dmp
memory/4836-158-0x0000020934050000-0x0000020934060000-memory.dmp
memory/4836-40-0x0000020934080000-0x0000020934090000-memory.dmp
memory/4836-44-0x0000020934090000-0x00000209340A0000-memory.dmp
memory/4836-43-0x0000020933FF0000-0x0000020934000000-memory.dmp
memory/4836-39-0x0000020934070000-0x0000020934080000-memory.dmp
memory/4836-47-0x0000020934000000-0x0000020934010000-memory.dmp
memory/4836-50-0x0000020934010000-0x0000020934020000-memory.dmp
memory/4836-49-0x00000209340B0000-0x00000209340C0000-memory.dmp
memory/4836-48-0x00000209340A0000-0x00000209340B0000-memory.dmp
memory/4836-54-0x00000209340C0000-0x00000209340D0000-memory.dmp
memory/4836-53-0x0000020934030000-0x0000020934040000-memory.dmp
memory/4836-57-0x00000209340D0000-0x00000209340E0000-memory.dmp
memory/4836-52-0x0000020934020000-0x0000020934030000-memory.dmp
memory/4836-59-0x00000209340E0000-0x00000209340F0000-memory.dmp
memory/4836-58-0x0000020934040000-0x0000020934050000-memory.dmp
memory/4836-38-0x0000020933D70000-0x0000020933FE0000-memory.dmp
memory/4836-61-0x0000020934050000-0x0000020934060000-memory.dmp
memory/4836-67-0x0000020934100000-0x0000020934110000-memory.dmp
memory/4836-66-0x0000020934060000-0x0000020934070000-memory.dmp
memory/4836-71-0x0000020934070000-0x0000020934080000-memory.dmp
memory/4836-72-0x0000020934110000-0x0000020934120000-memory.dmp
memory/4836-76-0x0000020934120000-0x0000020934130000-memory.dmp
memory/4836-75-0x0000020934080000-0x0000020934090000-memory.dmp
memory/4836-79-0x0000020934090000-0x00000209340A0000-memory.dmp
memory/4836-80-0x0000020934130000-0x0000020934140000-memory.dmp
memory/4836-83-0x0000020934140000-0x0000020934150000-memory.dmp
memory/4836-82-0x00000209340B0000-0x00000209340C0000-memory.dmp
memory/4836-81-0x00000209340A0000-0x00000209340B0000-memory.dmp
memory/4836-91-0x0000020934160000-0x0000020934170000-memory.dmp
memory/4836-93-0x0000020934180000-0x0000020934190000-memory.dmp
memory/4836-92-0x00000209340D0000-0x00000209340E0000-memory.dmp
memory/4836-90-0x00000209340C0000-0x00000209340D0000-memory.dmp
memory/4836-89-0x0000020934170000-0x0000020934180000-memory.dmp
memory/4836-88-0x0000020934150000-0x0000020934160000-memory.dmp
memory/4836-98-0x0000020932730000-0x0000020932731000-memory.dmp
memory/4836-101-0x0000020934190000-0x00000209341A0000-memory.dmp
memory/4836-100-0x00000209340E0000-0x00000209340F0000-memory.dmp
memory/4836-104-0x00000209340F0000-0x0000020934100000-memory.dmp
memory/4836-106-0x00000209341A0000-0x00000209341B0000-memory.dmp
memory/4836-103-0x0000020932730000-0x0000020932731000-memory.dmp
memory/4836-108-0x00000209341B0000-0x00000209341C0000-memory.dmp
memory/4836-107-0x0000020934100000-0x0000020934110000-memory.dmp
memory/4836-111-0x00000209341C0000-0x00000209341D0000-memory.dmp
memory/4836-110-0x0000020934110000-0x0000020934120000-memory.dmp
memory/4836-114-0x00000209341D0000-0x00000209341E0000-memory.dmp
memory/4836-113-0x0000020934120000-0x0000020934130000-memory.dmp
memory/4836-116-0x0000020934130000-0x0000020934140000-memory.dmp
memory/4836-117-0x00000209341E0000-0x00000209341F0000-memory.dmp
memory/4836-121-0x0000020934150000-0x0000020934160000-memory.dmp
memory/4836-41-0x0000020933FE0000-0x0000020933FF0000-memory.dmp
memory/4836-122-0x00000209341F0000-0x0000020934200000-memory.dmp
memory/4836-172-0x0000020934170000-0x0000020934180000-memory.dmp
memory/4836-124-0x0000020934170000-0x0000020934180000-memory.dmp
memory/4836-127-0x0000020932730000-0x0000020932731000-memory.dmp
memory/4836-132-0x0000020934210000-0x0000020934220000-memory.dmp
memory/4836-131-0x0000020934160000-0x0000020934170000-memory.dmp
memory/4836-136-0x0000020934180000-0x0000020934190000-memory.dmp
memory/4836-137-0x0000020934220000-0x0000020934230000-memory.dmp
memory/4836-142-0x0000020932730000-0x0000020932731000-memory.dmp
memory/4836-143-0x0000020934190000-0x00000209341A0000-memory.dmp
memory/4836-145-0x00000209341A0000-0x00000209341B0000-memory.dmp
memory/4836-146-0x00000209341B0000-0x00000209341C0000-memory.dmp
memory/4836-156-0x0000020934030000-0x0000020934040000-memory.dmp
memory/4836-160-0x0000020934070000-0x0000020934080000-memory.dmp
memory/4836-176-0x00000209341F0000-0x0000020934200000-memory.dmp
memory/4836-175-0x00000209341E0000-0x00000209341F0000-memory.dmp
memory/4836-174-0x00000209341D0000-0x00000209341E0000-memory.dmp
memory/4836-173-0x00000209341C0000-0x00000209341D0000-memory.dmp
memory/4836-125-0x0000020934200000-0x0000020934210000-memory.dmp
memory/4836-171-0x0000020934160000-0x0000020934170000-memory.dmp
memory/4836-36-0x0000020932730000-0x0000020932731000-memory.dmp
memory/4836-30-0x0000020934060000-0x0000020934070000-memory.dmp
memory/4836-29-0x0000020934050000-0x0000020934060000-memory.dmp
memory/4836-27-0x0000020934040000-0x0000020934050000-memory.dmp
memory/4836-23-0x0000020934020000-0x0000020934030000-memory.dmp
memory/4836-170-0x0000020934120000-0x0000020934130000-memory.dmp
memory/4836-169-0x0000020934110000-0x0000020934120000-memory.dmp
memory/4836-168-0x00000209340F0000-0x0000020934100000-memory.dmp
memory/4836-167-0x00000209340E0000-0x00000209340F0000-memory.dmp
memory/4836-166-0x00000209340D0000-0x00000209340E0000-memory.dmp
memory/4836-165-0x00000209340C0000-0x00000209340D0000-memory.dmp
memory/4836-164-0x00000209340B0000-0x00000209340C0000-memory.dmp
memory/4836-163-0x00000209340A0000-0x00000209340B0000-memory.dmp
memory/4836-162-0x0000020934090000-0x00000209340A0000-memory.dmp
memory/4836-161-0x0000020933D70000-0x0000020933FE0000-memory.dmp
memory/4836-159-0x0000020934060000-0x0000020934070000-memory.dmp
memory/4836-120-0x0000020934140000-0x0000020934150000-memory.dmp
memory/4836-157-0x0000020934040000-0x0000020934050000-memory.dmp
memory/4836-155-0x0000020934020000-0x0000020934030000-memory.dmp
memory/4836-154-0x0000020934010000-0x0000020934020000-memory.dmp
memory/4836-153-0x0000020934000000-0x0000020934010000-memory.dmp
memory/4836-152-0x0000020933FF0000-0x0000020934000000-memory.dmp
memory/4836-151-0x0000020933FE0000-0x0000020933FF0000-memory.dmp
memory/4836-150-0x0000020934080000-0x0000020934090000-memory.dmp
memory/4836-24-0x0000020934030000-0x0000020934040000-memory.dmp
memory/4836-20-0x0000020934010000-0x0000020934020000-memory.dmp
memory/4836-18-0x0000020934000000-0x0000020934010000-memory.dmp
memory/4836-16-0x0000020933FF0000-0x0000020934000000-memory.dmp
memory/4836-14-0x0000020933FE0000-0x0000020933FF0000-memory.dmp
memory/4836-4-0x0000020933D70000-0x0000020933FE0000-memory.dmp