Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
05/10/2024, 14:33
General
- Target 185.jar
- Size 14.5MB
- Sample241005-rxab8szcle
- SHA256 287e892aeb4be05c881e19da227d0398cd321d5a9af837932c12dfaab641b4cb
Malware Config
Signatures
- Dynamic RAT payload 1 IoCs
- DynamicRat
DynamicRat is a remote access trojan malware written in Java.
- Drops startup file 2 IoCs
- Loads dropped DLL 3 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\185.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\m17281388419936734206489595053474.tmp" DELAY:32⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll
jna688148889730729821.dll
m17281388419936734206489595053474.tmp
83aa4cc77f591dfc2374580bbd95f6ba_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
memory/1092-192-0x000001C268D10000-0x000001C268D20000-memory.dmp
memory/1092-185-0x000001C268D00000-0x000001C268D10000-memory.dmp
memory/1092-247-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-242-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-232-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-210-0x000001C268CC0000-0x000001C268CD0000-memory.dmp
memory/1092-211-0x000001C268D80000-0x000001C268D90000-memory.dmp
memory/1092-209-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-204-0x000001C268CB0000-0x000001C268CC0000-memory.dmp
memory/1092-205-0x000001C268D40000-0x000001C268D50000-memory.dmp
memory/1092-206-0x000001C268D50000-0x000001C268D60000-memory.dmp
memory/1092-207-0x000001C268D60000-0x000001C268D70000-memory.dmp
memory/1092-208-0x000001C268D70000-0x000001C268D80000-memory.dmp
memory/1092-203-0x000001C268CA0000-0x000001C268CB0000-memory.dmp
memory/1092-197-0x000001C268C90000-0x000001C268CA0000-memory.dmp
memory/1092-198-0x000001C268D30000-0x000001C268D40000-memory.dmp
memory/1092-195-0x000001C268D20000-0x000001C268D30000-memory.dmp
memory/1092-257-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-182-0x000001C268CF0000-0x000001C268D00000-memory.dmp
memory/1092-181-0x000001C268C70000-0x000001C268C80000-memory.dmp
memory/1092-184-0x000001C268C80000-0x000001C268C90000-memory.dmp
memory/1092-241-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-174-0x000001C2689E0000-0x000001C268C50000-memory.dmp
memory/1092-175-0x000001C268CC0000-0x000001C268CD0000-memory.dmp
memory/1092-176-0x000001C268CD0000-0x000001C268CE0000-memory.dmp
memory/1092-178-0x000001C268C60000-0x000001C268C70000-memory.dmp
memory/1092-179-0x000001C268CE0000-0x000001C268CF0000-memory.dmp
memory/1092-177-0x000001C268C50000-0x000001C268C60000-memory.dmp
memory/1092-171-0x000001C268CB0000-0x000001C268CC0000-memory.dmp
memory/1092-168-0x000001C268CA0000-0x000001C268CB0000-memory.dmp
memory/1092-265-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-160-0x000001C268C90000-0x000001C268CA0000-memory.dmp
memory/1092-134-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-131-0x000001C268C80000-0x000001C268C90000-memory.dmp
memory/1092-267-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-128-0x000001C268C70000-0x000001C268C80000-memory.dmp
memory/1092-126-0x000001C268C60000-0x000001C268C70000-memory.dmp
memory/1092-275-0x000001C267160000-0x000001C267161000-memory.dmp
memory/1092-102-0x000001C2689E0000-0x000001C268C50000-memory.dmp
memory/1092-122-0x000001C268C50000-0x000001C268C60000-memory.dmp
memory/1092-283-0x000001C268CD0000-0x000001C268CE0000-memory.dmp
memory/1092-112-0x000001C267160000-0x000001C267161000-memory.dmp
memory/3668-59-0x0000026C27C50000-0x0000026C27C60000-memory.dmp
memory/3668-71-0x0000026C27BF0000-0x0000026C27C00000-memory.dmp
memory/3668-121-0x0000026C27C40000-0x0000026C27C50000-memory.dmp
memory/3668-124-0x0000026C27C50000-0x0000026C27C60000-memory.dmp
memory/3668-96-0x0000026C27CC0000-0x0000026C27CD0000-memory.dmp
memory/3668-125-0x0000026C27C60000-0x0000026C27C70000-memory.dmp
memory/3668-95-0x0000026C27C20000-0x0000026C27C30000-memory.dmp
memory/3668-85-0x0000026C27C10000-0x0000026C27C20000-memory.dmp
memory/3668-130-0x0000026C27C70000-0x0000026C27C80000-memory.dmp
memory/3668-86-0x0000026C27CB0000-0x0000026C27CC0000-memory.dmp
memory/3668-135-0x0000026C27C80000-0x0000026C27C90000-memory.dmp
memory/3668-139-0x0000026C26050000-0x0000026C26051000-memory.dmp
memory/3668-140-0x0000026C278E0000-0x0000026C27B50000-memory.dmp
memory/3668-158-0x0000026C27CC0000-0x0000026C27CD0000-memory.dmp
memory/3668-157-0x0000026C27CB0000-0x0000026C27CC0000-memory.dmp
memory/3668-156-0x0000026C27CA0000-0x0000026C27CB0000-memory.dmp
memory/3668-155-0x0000026C27C90000-0x0000026C27CA0000-memory.dmp
memory/3668-154-0x0000026C27C30000-0x0000026C27C40000-memory.dmp
memory/3668-153-0x0000026C27C20000-0x0000026C27C30000-memory.dmp
memory/3668-152-0x0000026C27C00000-0x0000026C27C10000-memory.dmp
memory/3668-151-0x0000026C27BF0000-0x0000026C27C00000-memory.dmp
memory/3668-150-0x0000026C27BE0000-0x0000026C27BF0000-memory.dmp
memory/3668-149-0x0000026C27BD0000-0x0000026C27BE0000-memory.dmp
memory/3668-148-0x0000026C27BC0000-0x0000026C27BD0000-memory.dmp
memory/3668-147-0x0000026C27BB0000-0x0000026C27BC0000-memory.dmp
memory/3668-146-0x0000026C27BA0000-0x0000026C27BB0000-memory.dmp
memory/3668-145-0x0000026C27B90000-0x0000026C27BA0000-memory.dmp
memory/3668-144-0x0000026C27B80000-0x0000026C27B90000-memory.dmp
memory/3668-143-0x0000026C27B70000-0x0000026C27B80000-memory.dmp
memory/3668-142-0x0000026C27B60000-0x0000026C27B70000-memory.dmp
memory/3668-141-0x0000026C27B50000-0x0000026C27B60000-memory.dmp
memory/3668-79-0x0000026C27C00000-0x0000026C27C10000-memory.dmp
memory/3668-80-0x0000026C27CA0000-0x0000026C27CB0000-memory.dmp
memory/3668-101-0x0000026C27C30000-0x0000026C27C40000-memory.dmp
memory/3668-72-0x0000026C27C90000-0x0000026C27CA0000-memory.dmp
memory/3668-68-0x0000026C27BE0000-0x0000026C27BF0000-memory.dmp
memory/3668-69-0x0000026C27C80000-0x0000026C27C90000-memory.dmp
memory/3668-63-0x0000026C27BD0000-0x0000026C27BE0000-memory.dmp
memory/3668-64-0x0000026C27C70000-0x0000026C27C80000-memory.dmp
memory/3668-2-0x0000026C278E0000-0x0000026C27B50000-memory.dmp
memory/3668-60-0x0000026C27C60000-0x0000026C27C70000-memory.dmp
memory/3668-61-0x0000026C27BC0000-0x0000026C27BD0000-memory.dmp
memory/3668-55-0x0000026C27BB0000-0x0000026C27BC0000-memory.dmp
memory/3668-56-0x0000026C27C40000-0x0000026C27C50000-memory.dmp
memory/3668-54-0x0000026C27BA0000-0x0000026C27BB0000-memory.dmp
memory/3668-51-0x0000026C27B90000-0x0000026C27BA0000-memory.dmp
memory/3668-52-0x0000026C27C30000-0x0000026C27C40000-memory.dmp
memory/3668-42-0x0000026C27B60000-0x0000026C27B70000-memory.dmp
memory/3668-47-0x0000026C27B80000-0x0000026C27B90000-memory.dmp
memory/3668-48-0x0000026C27C20000-0x0000026C27C30000-memory.dmp
memory/3668-44-0x0000026C27B70000-0x0000026C27B80000-memory.dmp
memory/3668-45-0x0000026C27C10000-0x0000026C27C20000-memory.dmp
memory/3668-43-0x0000026C27C00000-0x0000026C27C10000-memory.dmp
memory/3668-39-0x0000026C27B50000-0x0000026C27B60000-memory.dmp
memory/3668-40-0x0000026C27BF0000-0x0000026C27C00000-memory.dmp
memory/3668-36-0x0000026C27BE0000-0x0000026C27BF0000-memory.dmp
memory/3668-35-0x0000026C278E0000-0x0000026C27B50000-memory.dmp
memory/3668-34-0x0000026C27BD0000-0x0000026C27BE0000-memory.dmp
memory/3668-31-0x0000026C27BC0000-0x0000026C27BD0000-memory.dmp
memory/3668-29-0x0000026C27BB0000-0x0000026C27BC0000-memory.dmp
memory/3668-28-0x0000026C27BA0000-0x0000026C27BB0000-memory.dmp
memory/3668-26-0x0000026C27B90000-0x0000026C27BA0000-memory.dmp
memory/3668-23-0x0000026C27B80000-0x0000026C27B90000-memory.dmp
memory/3668-21-0x0000026C27B70000-0x0000026C27B80000-memory.dmp
memory/3668-19-0x0000026C27B60000-0x0000026C27B70000-memory.dmp
memory/3668-17-0x0000026C27B50000-0x0000026C27B60000-memory.dmp
memory/3668-15-0x0000026C26050000-0x0000026C26051000-memory.dmp