Analysis
- max time kernel
148s - max time network
151s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
05/10/2024, 14:33
General
- Target 185.jar
- Size 14.5MB
- Sample241005-rxab8szcle
- SHA256 287e892aeb4be05c881e19da227d0398cd321d5a9af837932c12dfaab641b4cb
Malware Config
Signatures
- Dynamic RAT payload 1 IoCs
- DynamicRat
DynamicRat is a remote access trojan malware written in Java.
- Drops startup file 2 IoCs
- Loads dropped DLL 3 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\185.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\m17281388413128031215267446672284.tmp" DELAY:32⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
m17281388413128031215267446672284.tmp
83aa4cc77f591dfc2374580bbd95f6ba_f4fe33a0-f73d-4d5c-8730-deeef20ef238
JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll
jna7415733984974618982.dll
memory/1260-98-0x000001D00B6E0000-0x000001D00B6F0000-memory.dmp
memory/1260-99-0x000001D00B780000-0x000001D00B790000-memory.dmp
memory/1260-20-0x000001D00B610000-0x000001D00B620000-memory.dmp
memory/1260-22-0x000001D00B620000-0x000001D00B630000-memory.dmp
memory/1260-24-0x000001D00B630000-0x000001D00B640000-memory.dmp
memory/1260-26-0x000001D00B640000-0x000001D00B650000-memory.dmp
memory/1260-29-0x000001D00B650000-0x000001D00B660000-memory.dmp
memory/1260-30-0x000001D00B660000-0x000001D00B670000-memory.dmp
memory/1260-32-0x000001D00B670000-0x000001D00B680000-memory.dmp
memory/1260-34-0x000001D00B680000-0x000001D00B690000-memory.dmp
memory/1260-39-0x000001D00B390000-0x000001D00B600000-memory.dmp
memory/1260-44-0x000001D00B600000-0x000001D00B610000-memory.dmp
memory/1260-43-0x000001D00B6A0000-0x000001D00B6B0000-memory.dmp
memory/1260-42-0x000001D00B6C0000-0x000001D00B6D0000-memory.dmp
memory/1260-41-0x000001D00B6B0000-0x000001D00B6C0000-memory.dmp
memory/1260-40-0x000001D00B690000-0x000001D00B6A0000-memory.dmp
memory/1260-48-0x000001D00B6D0000-0x000001D00B6E0000-memory.dmp
memory/1260-134-0x000001D00B700000-0x000001D00B710000-memory.dmp
memory/1260-50-0x000001D00B6E0000-0x000001D00B6F0000-memory.dmp
memory/1260-49-0x000001D00B620000-0x000001D00B630000-memory.dmp
memory/1260-53-0x000001D00B6F0000-0x000001D00B700000-memory.dmp
memory/1260-52-0x000001D00B630000-0x000001D00B640000-memory.dmp
memory/1260-56-0x000001D00B700000-0x000001D00B710000-memory.dmp
memory/1260-55-0x000001D00B640000-0x000001D00B650000-memory.dmp
memory/1260-60-0x000001D00B710000-0x000001D00B720000-memory.dmp
memory/1260-59-0x000001D00B650000-0x000001D00B660000-memory.dmp
memory/1260-63-0x000001D00B660000-0x000001D00B670000-memory.dmp
memory/1260-64-0x000001D00B720000-0x000001D00B730000-memory.dmp
memory/1260-67-0x000001D00B730000-0x000001D00B740000-memory.dmp
memory/1260-66-0x000001D00B670000-0x000001D00B680000-memory.dmp
memory/1260-71-0x000001D00B740000-0x000001D00B750000-memory.dmp
memory/1260-70-0x000001D00B680000-0x000001D00B690000-memory.dmp
memory/1260-78-0x000001D00B750000-0x000001D00B760000-memory.dmp
memory/1260-77-0x000001D00B6C0000-0x000001D00B6D0000-memory.dmp
memory/1260-76-0x000001D00B6B0000-0x000001D00B6C0000-memory.dmp
memory/1260-75-0x000001D00B690000-0x000001D00B6A0000-memory.dmp
memory/1260-83-0x000001D00B760000-0x000001D00B770000-memory.dmp
memory/1260-82-0x000001D00B6A0000-0x000001D00B6B0000-memory.dmp
memory/1260-89-0x000001D00B6D0000-0x000001D00B6E0000-memory.dmp
memory/1260-90-0x000001D00B770000-0x000001D00B780000-memory.dmp
memory/1260-133-0x000001D00B370000-0x000001D00B371000-memory.dmp
memory/1260-16-0x000001D00B370000-0x000001D00B371000-memory.dmp
memory/1260-18-0x000001D00B600000-0x000001D00B610000-memory.dmp
memory/1260-105-0x000001D00B6F0000-0x000001D00B700000-memory.dmp
memory/1260-47-0x000001D00B610000-0x000001D00B620000-memory.dmp
memory/1260-2-0x000001D00B390000-0x000001D00B600000-memory.dmp
memory/1260-160-0x000001D00B780000-0x000001D00B790000-memory.dmp
memory/1260-159-0x000001D00B770000-0x000001D00B780000-memory.dmp
memory/1260-136-0x000001D00B6A0000-0x000001D00B6B0000-memory.dmp
memory/1260-137-0x000001D00B600000-0x000001D00B610000-memory.dmp
memory/1260-138-0x000001D00B610000-0x000001D00B620000-memory.dmp
memory/1260-139-0x000001D00B620000-0x000001D00B630000-memory.dmp
memory/1260-140-0x000001D00B630000-0x000001D00B640000-memory.dmp
memory/1260-141-0x000001D00B640000-0x000001D00B650000-memory.dmp
memory/1260-142-0x000001D00B650000-0x000001D00B660000-memory.dmp
memory/1260-143-0x000001D00B660000-0x000001D00B670000-memory.dmp
memory/1260-144-0x000001D00B670000-0x000001D00B680000-memory.dmp
memory/1260-145-0x000001D00B680000-0x000001D00B690000-memory.dmp
memory/1260-146-0x000001D00B690000-0x000001D00B6A0000-memory.dmp
memory/1260-147-0x000001D00B6B0000-0x000001D00B6C0000-memory.dmp
memory/1260-148-0x000001D00B6C0000-0x000001D00B6D0000-memory.dmp
memory/1260-149-0x000001D00B390000-0x000001D00B600000-memory.dmp
memory/1260-150-0x000001D00B6D0000-0x000001D00B6E0000-memory.dmp
memory/1260-151-0x000001D00B6E0000-0x000001D00B6F0000-memory.dmp
memory/1260-152-0x000001D00B6F0000-0x000001D00B700000-memory.dmp
memory/1260-153-0x000001D00B710000-0x000001D00B720000-memory.dmp
memory/1260-154-0x000001D00B720000-0x000001D00B730000-memory.dmp
memory/1260-155-0x000001D00B730000-0x000001D00B740000-memory.dmp
memory/1260-156-0x000001D00B740000-0x000001D00B750000-memory.dmp
memory/1260-157-0x000001D00B750000-0x000001D00B760000-memory.dmp
memory/1260-158-0x000001D00B760000-0x000001D00B770000-memory.dmp
memory/4492-222-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-224-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-108-0x000001DF39BC0000-0x000001DF39E30000-memory.dmp
memory/4492-187-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-193-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-207-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-115-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-221-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-236-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-135-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-240-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-241-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-244-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-242-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-251-0x000001DF382D0000-0x000001DF382D1000-memory.dmp
memory/4492-314-0x000001DF39BC0000-0x000001DF39E30000-memory.dmp