strrat | 51e912dd2285ec623b00678344a6b3ba933e244938fd1470a03d536cbff66a38

General

Target

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
Size

480KB
MD5

aac338140e178a3cac423d3454cc7467
SHA1

a9c195e15b4109d4ece1309fb4e3b3bd77145421
SHA256

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb
SHA512

a96b2c8c985feccbc385a8ba1e7583be6913db7da15244b136c203f7ca320a03727425f3927c21157eae0c4da3fbbdd8fb71373655c6824544296ec66df834f2
SSDEEP

12288:PkQNy5kuH2lZ6r4os6WQMiyvtJMDiXxJfrJyru:XvuHTr4J7Qw1JJXxJ0ru

Score

10^/10

strrat discovery stealer trojan

Malware Config

Extracted

Family

strrat

C2

93.185.156.124:1912

127.0.0.1:1912

Attributes

license_id
khonsari
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
true
secondary_startup
true
startup
true

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

description	pid	process	target process
PID 2716 set thread context of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

pid	process
2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

description pid process

Token: SeDebugPrivilege 2716 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

description	pid	process
Token: SeDebugPrivilege	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.execmd.exe

description	pid	process	target process
PID 2716 wrote to memory of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
PID 2716 wrote to memory of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
PID 2716 wrote to memory of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
PID 2716 wrote to memory of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
PID 2716 wrote to memory of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
PID 2716 wrote to memory of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
PID 2716 wrote to memory of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
PID 2716 wrote to memory of 2888	2716	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
PID 2888 wrote to memory of 2844	2888	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	cmd.exe
PID 2888 wrote to memory of 2844	2888	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	cmd.exe
PID 2888 wrote to memory of 2844	2888	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	cmd.exe
PID 2888 wrote to memory of 2844	2888	461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe	cmd.exe
PID 2844 wrote to memory of 2632	2844	cmd.exe	javaw.exe
PID 2844 wrote to memory of 2632	2844	cmd.exe	javaw.exe
PID 2844 wrote to memory of 2632	2844	cmd.exe	javaw.exe
PID 2844 wrote to memory of 2632	2844	cmd.exe	javaw.exe

C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
"C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
  "C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\A.jar"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\A.jar"
      4⤵
      PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A.jar

Filesize
92KB

MD5
105a14c6fce083e80f49b30db88ec915

SHA1
46187697a87562210e785917ce6ca16aeb4912b3

SHA256
7e5adae008afee158168b1943fcc41157c7de63ab4792cc5eba8d1830edd6d65

SHA512
2322eeeb100b644d53641ec3c1b0588579565636a2ea934924931f6f77b156b6d4e5925a2f36b0520e1f568d771860af53e9f3c39bb5238f7e7520389692c963

Download Submit
memory/2632-71-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2632-70-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2632-61-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2632-59-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2632-52-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2632-46-0x0000000074310000-0x0000000074AE9000-memory.dmp

Filesize
7.8MB

Download
memory/2716-5-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2716-0-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2716-1-0x00000000009C0000-0x0000000000A3C000-memory.dmp

Filesize
496KB

Download
memory/2716-2-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2716-3-0x00000000040B0000-0x0000000004124000-memory.dmp

Filesize
464KB

Download
memory/2716-4-0x0000000000380000-0x0000000000390000-memory.dmp

Filesize
64KB

Download
memory/2716-6-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2716-24-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2716-7-0x00000000048F0000-0x0000000004950000-memory.dmp

Filesize
384KB

Download
memory/2888-10-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2888-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2888-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2888-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-16-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2888-14-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads