Analysis
- max time kernel
146s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240910-en - resource tags
- submitted
06/10/2024, 01:04
General
- Target 287e892aeb4be05c881e19da227d0398cd321d5a9af837932c12dfaab641b4cb.jar
- Size 14.5MB
- Sample241006-be925ssfnf
- SHA256 287e892aeb4be05c881e19da227d0398cd321d5a9af837932c12dfaab641b4cb
Malware Config
Signatures
- Dynamic RAT payload 1 IoCs
- DynamicRat
DynamicRat is a remote access trojan malware written in Java.
- Drops startup file 2 IoCs
- Loads dropped DLL 3 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\287e892aeb4be05c881e19da227d0398cd321d5a9af837932c12dfaab641b4cb.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\m172817669034923548742597643781.tmp" DELAY:32⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll
jna541101327063765782.dll
m172817669034923548742597643781.tmp
83aa4cc77f591dfc2374580bbd95f6ba_83e33dcf-e635-4313-9cdc-036589dffc77
memory/2044-175-0x0000017917E50000-0x0000017917E60000-memory.dmp
memory/2044-104-0x0000017917B80000-0x0000017917DF0000-memory.dmp
memory/2044-281-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-275-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-272-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-262-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-267-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-245-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-223-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-222-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-211-0x0000017917EF0000-0x0000017917F00000-memory.dmp
memory/2044-212-0x0000017917F00000-0x0000017917F10000-memory.dmp
memory/2044-213-0x0000017917F10000-0x0000017917F20000-memory.dmp
memory/2044-210-0x0000017917E50000-0x0000017917E60000-memory.dmp
memory/2044-205-0x0000017917E40000-0x0000017917E50000-memory.dmp
memory/2044-206-0x0000017917EE0000-0x0000017917EF0000-memory.dmp
memory/2044-203-0x0000017917ED0000-0x0000017917EE0000-memory.dmp
memory/2044-200-0x0000017917EC0000-0x0000017917ED0000-memory.dmp
memory/2044-199-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-189-0x0000017917E30000-0x0000017917E40000-memory.dmp
memory/2044-190-0x0000017917EA0000-0x0000017917EB0000-memory.dmp
memory/2044-178-0x0000017917DF0000-0x0000017917E00000-memory.dmp
memory/2044-180-0x0000017917E60000-0x0000017917E70000-memory.dmp
memory/2044-187-0x0000017917E90000-0x0000017917EA0000-memory.dmp
memory/2044-183-0x0000017917E10000-0x0000017917E20000-memory.dmp
memory/2044-184-0x0000017917E20000-0x0000017917E30000-memory.dmp
memory/2044-185-0x0000017917E80000-0x0000017917E90000-memory.dmp
memory/2044-181-0x0000017917E70000-0x0000017917E80000-memory.dmp
memory/2044-139-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/2044-182-0x0000017917E00000-0x0000017917E10000-memory.dmp
memory/2044-174-0x0000017917B80000-0x0000017917DF0000-memory.dmp
memory/2044-166-0x0000017917E40000-0x0000017917E50000-memory.dmp
memory/2044-195-0x0000017917EB0000-0x0000017917EC0000-memory.dmp
memory/2044-131-0x0000017917E10000-0x0000017917E20000-memory.dmp
memory/2044-132-0x0000017917E20000-0x0000017917E30000-memory.dmp
memory/2044-136-0x0000017917E30000-0x0000017917E40000-memory.dmp
memory/2044-128-0x0000017917E00000-0x0000017917E10000-memory.dmp
memory/2044-125-0x0000017917DF0000-0x0000017917E00000-memory.dmp
memory/2044-114-0x0000017917B60000-0x0000017917B61000-memory.dmp
memory/4740-71-0x0000020B37240000-0x0000020B37250000-memory.dmp
memory/4740-148-0x0000020B371D0000-0x0000020B371E0000-memory.dmp
memory/4740-20-0x0000020B371C0000-0x0000020B371D0000-memory.dmp
memory/4740-22-0x0000020B371D0000-0x0000020B371E0000-memory.dmp
memory/4740-18-0x0000020B371B0000-0x0000020B371C0000-memory.dmp
memory/4740-99-0x0000020B37330000-0x0000020B37340000-memory.dmp
memory/4740-98-0x0000020B37290000-0x0000020B372A0000-memory.dmp
memory/4740-127-0x0000020B372D0000-0x0000020B372E0000-memory.dmp
memory/4740-126-0x0000020B372C0000-0x0000020B372D0000-memory.dmp
memory/4740-124-0x0000020B372B0000-0x0000020B372C0000-memory.dmp
memory/4740-133-0x0000020B372E0000-0x0000020B372F0000-memory.dmp
memory/4740-135-0x0000020B372F0000-0x0000020B37300000-memory.dmp
memory/4740-24-0x0000020B371E0000-0x0000020B371F0000-memory.dmp
memory/4740-88-0x0000020B37320000-0x0000020B37330000-memory.dmp
memory/4740-85-0x0000020B37280000-0x0000020B37290000-memory.dmp
memory/4740-29-0x0000020B37200000-0x0000020B37210000-memory.dmp
memory/4740-86-0x0000020B37310000-0x0000020B37320000-memory.dmp
memory/4740-50-0x0000020B371E0000-0x0000020B371F0000-memory.dmp
memory/4740-145-0x0000020B37240000-0x0000020B37250000-memory.dmp
memory/4740-153-0x0000020B37220000-0x0000020B37230000-memory.dmp
memory/4740-152-0x0000020B37210000-0x0000020B37220000-memory.dmp
memory/4740-164-0x0000020B37330000-0x0000020B37340000-memory.dmp
memory/4740-163-0x0000020B37320000-0x0000020B37330000-memory.dmp
memory/4740-162-0x0000020B37310000-0x0000020B37320000-memory.dmp
memory/4740-161-0x0000020B372B0000-0x0000020B372C0000-memory.dmp
memory/4740-160-0x0000020B37290000-0x0000020B372A0000-memory.dmp
memory/4740-159-0x0000020B37280000-0x0000020B37290000-memory.dmp
memory/4740-158-0x0000020B37270000-0x0000020B37280000-memory.dmp
memory/4740-157-0x0000020B37260000-0x0000020B37270000-memory.dmp
memory/4740-154-0x0000020B37230000-0x0000020B37240000-memory.dmp
memory/4740-156-0x0000020B36F40000-0x0000020B371B0000-memory.dmp
memory/4740-155-0x0000020B37250000-0x0000020B37260000-memory.dmp
memory/4740-151-0x0000020B37200000-0x0000020B37210000-memory.dmp
memory/4740-150-0x0000020B371F0000-0x0000020B37200000-memory.dmp
memory/4740-149-0x0000020B371E0000-0x0000020B371F0000-memory.dmp
memory/4740-103-0x0000020B372A0000-0x0000020B372B0000-memory.dmp
memory/4740-147-0x0000020B371C0000-0x0000020B371D0000-memory.dmp
memory/4740-146-0x0000020B371B0000-0x0000020B371C0000-memory.dmp
memory/4740-84-0x0000020B37270000-0x0000020B37280000-memory.dmp
memory/4740-15-0x0000020B35690000-0x0000020B35691000-memory.dmp
memory/4740-2-0x0000020B36F40000-0x0000020B371B0000-memory.dmp
memory/4740-75-0x0000020B37260000-0x0000020B37270000-memory.dmp
memory/4740-76-0x0000020B37300000-0x0000020B37310000-memory.dmp
memory/4740-72-0x0000020B372F0000-0x0000020B37300000-memory.dmp
memory/4740-67-0x0000020B372E0000-0x0000020B372F0000-memory.dmp
memory/4740-60-0x0000020B37210000-0x0000020B37220000-memory.dmp
memory/4740-61-0x0000020B372C0000-0x0000020B372D0000-memory.dmp
memory/4740-66-0x0000020B37250000-0x0000020B37260000-memory.dmp
memory/4740-62-0x0000020B372D0000-0x0000020B372E0000-memory.dmp
memory/4740-63-0x0000020B37220000-0x0000020B37230000-memory.dmp
memory/4740-57-0x0000020B372B0000-0x0000020B372C0000-memory.dmp
memory/4740-56-0x0000020B37200000-0x0000020B37210000-memory.dmp
memory/4740-140-0x0000020B37300000-0x0000020B37310000-memory.dmp
memory/4740-46-0x0000020B371C0000-0x0000020B371D0000-memory.dmp
memory/4740-53-0x0000020B371F0000-0x0000020B37200000-memory.dmp
memory/4740-54-0x0000020B372A0000-0x0000020B372B0000-memory.dmp
memory/4740-47-0x0000020B37270000-0x0000020B37280000-memory.dmp
memory/4740-48-0x0000020B37280000-0x0000020B37290000-memory.dmp
memory/4740-144-0x0000020B35690000-0x0000020B35691000-memory.dmp
memory/4740-51-0x0000020B37290000-0x0000020B372A0000-memory.dmp
memory/4740-49-0x0000020B371D0000-0x0000020B371E0000-memory.dmp
memory/4740-37-0x0000020B36F40000-0x0000020B371B0000-memory.dmp
memory/4740-38-0x0000020B37230000-0x0000020B37240000-memory.dmp
memory/4740-39-0x0000020B37250000-0x0000020B37260000-memory.dmp
memory/4740-41-0x0000020B371B0000-0x0000020B371C0000-memory.dmp
memory/4740-42-0x0000020B37260000-0x0000020B37270000-memory.dmp
memory/4740-40-0x0000020B37240000-0x0000020B37250000-memory.dmp
memory/4740-32-0x0000020B37220000-0x0000020B37230000-memory.dmp
memory/4740-30-0x0000020B37210000-0x0000020B37220000-memory.dmp
memory/4740-27-0x0000020B371F0000-0x0000020B37200000-memory.dmp