Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
05/10/2024, 14:33
General
-
Target
185.jar
-
Size
14.5MB
-
MD5
29fd6772aafb08c90b1ff9a91f48ecff
-
SHA1
39628a8412e0a14126da2bfa5fbe7af5069e1eec
-
SHA256
287e892aeb4be05c881e19da227d0398cd321d5a9af837932c12dfaab641b4cb
-
SHA512
4d75584621d843d16ed97986e123be2751478e8047ac43a8a722daa3a548a2833293f0cc86ae9c229b4a2df2ae9a69e7e3ce3333da3696c48a4712d52950173e
-
SSDEEP
393216:hU+MrvMUXlIm0QEiK4JISelo4pOT0w03Bl:hSIelIvgJYlIIF3/
Malware Config
Signatures
-
Dynamic RAT payload 1 IoCs
-
DynamicRat
DynamicRat is a remote access trojan malware written in Java.
-
Drops startup file 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\185.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\m17281388413128031215267446672284.tmp" DELAY:32⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD50c76e8aaf75fe20df66848720039664d
SHA1553ba696c52c17352fc6e262a5a7d22ffe40bc1f
SHA256ec99091cc62229be41654917f84562e22fa1c467402f1e1c8670ecb3014b4e67
SHA512e82736dbd0d3d6e1e1ae031430681c72e96ca3608d3cbf597802204c067495c0433e803601a6d917326dcb05cbd865e0cf686b4e64625ba11402a1cc37997dae
-
Filesize
13.9MB
MD5a74e3a679307d0c527f75e471229a6b0
SHA1aea3fe7535be76a64ad06292dae50595abf5e3a8
SHA256cc1f7f46569c47b6aaf3000374073e30f92350b876d69bc02771664fa5212014
SHA512bfd7c2ea7e31b404d70d68e21f3e597cc8a548be4ecc745a795106fa946f15b67636598a8c78fc8f8d7e1bbe226982cabbfc8169cbe20d2548ca7478589d018d
-
Filesize
45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
80KB
MD5e9a449971b9efb0a2e12b9cfdd95c076
SHA1385777659fa84e94a3812eb9a8afad27ae3ceed4
SHA256b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18
SHA512bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d
-
Filesize
248KB
MD54de85f9679c3a75f6d7d3e56094aa106
SHA1052f62fb2ebec89fbe412db480865910eab693ad
SHA2563d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc
SHA512e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.4MB