Analysis
- max time kernel
146s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/10/2024, 18:09
General
- Target Payment.Telex-pdf2.jar
- Size 316KB
- Sample241014-wrvs7sydra
- SHA256 0c10cc3d71089b66a0f5de22c6ebdba38d259ff11e3e06b2e75a47057bb39695
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Payment.Telex-pdf2.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\Payment.Telex-pdf2.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Payment.Telex-pdf2.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Payment.Telex-pdf2.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Payment.Telex-pdf2.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
jna4242253134358929557.dll
83aa4cc77f591dfc2374580bbd95f6ba_896de533-e5fb-4eb9-8f2b-d363f3584dc5
Payment.Telex-pdf2.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/2208-258-0x000001E896560000-0x000001E896561000-memory.dmp
memory/4464-110-0x0000020142BB0000-0x0000020142BB1000-memory.dmp
memory/4464-160-0x0000020144770000-0x0000020144780000-memory.dmp
memory/4464-34-0x0000020144780000-0x0000020144790000-memory.dmp
memory/4464-39-0x00000201447A0000-0x00000201447B0000-memory.dmp
memory/4464-38-0x0000020144700000-0x0000020144710000-memory.dmp
memory/4464-33-0x0000020144770000-0x0000020144780000-memory.dmp
memory/4464-42-0x00000201447B0000-0x00000201447C0000-memory.dmp
memory/4464-55-0x0000020144750000-0x0000020144760000-memory.dmp
memory/4464-54-0x0000020144740000-0x0000020144750000-memory.dmp
memory/4464-53-0x00000201447F0000-0x0000020144800000-memory.dmp
memory/4464-52-0x00000201447E0000-0x00000201447F0000-memory.dmp
memory/4464-50-0x00000201447D0000-0x00000201447E0000-memory.dmp
memory/4464-49-0x00000201447C0000-0x00000201447D0000-memory.dmp
memory/4464-48-0x0000020144730000-0x0000020144740000-memory.dmp
memory/4464-47-0x0000020144720000-0x0000020144730000-memory.dmp
memory/4464-41-0x0000020144710000-0x0000020144720000-memory.dmp
memory/4464-58-0x0000020144800000-0x0000020144810000-memory.dmp
memory/4464-59-0x0000020142BB0000-0x0000020142BB1000-memory.dmp
memory/4464-64-0x0000020144810000-0x0000020144820000-memory.dmp
memory/4464-63-0x0000020144760000-0x0000020144770000-memory.dmp
memory/4464-68-0x0000020144820000-0x0000020144830000-memory.dmp
memory/4464-70-0x0000020144780000-0x0000020144790000-memory.dmp
memory/4464-69-0x0000020144830000-0x0000020144840000-memory.dmp
memory/4464-67-0x0000020144770000-0x0000020144780000-memory.dmp
memory/4464-73-0x0000020144790000-0x00000201447A0000-memory.dmp
memory/4464-74-0x0000020144840000-0x0000020144850000-memory.dmp
memory/4464-77-0x0000020144850000-0x0000020144860000-memory.dmp
memory/4464-76-0x00000201447A0000-0x00000201447B0000-memory.dmp
memory/4464-79-0x0000020144860000-0x0000020144870000-memory.dmp
memory/4464-78-0x00000201447B0000-0x00000201447C0000-memory.dmp
memory/4464-84-0x00000201447E0000-0x00000201447F0000-memory.dmp
memory/4464-85-0x0000020144870000-0x0000020144880000-memory.dmp
memory/4464-83-0x00000201447D0000-0x00000201447E0000-memory.dmp
memory/4464-82-0x00000201447C0000-0x00000201447D0000-memory.dmp
memory/4464-87-0x0000020144880000-0x0000020144890000-memory.dmp
memory/4464-91-0x0000020144890000-0x00000201448A0000-memory.dmp
memory/4464-90-0x00000201447F0000-0x0000020144800000-memory.dmp
memory/4464-94-0x0000020144800000-0x0000020144810000-memory.dmp
memory/4464-96-0x00000201448A0000-0x00000201448B0000-memory.dmp
memory/4464-93-0x0000020142BB0000-0x0000020142BB1000-memory.dmp
memory/4464-98-0x00000201448B0000-0x00000201448C0000-memory.dmp
memory/4464-97-0x0000020144810000-0x0000020144820000-memory.dmp
memory/4464-105-0x00000201448C0000-0x00000201448D0000-memory.dmp
memory/4464-104-0x0000020144830000-0x0000020144840000-memory.dmp
memory/4464-103-0x0000020144820000-0x0000020144830000-memory.dmp
memory/4464-106-0x0000020142BB0000-0x0000020142BB1000-memory.dmp
memory/4464-108-0x00000201448D0000-0x00000201448E0000-memory.dmp
memory/4464-2-0x0000020144490000-0x0000020144700000-memory.dmp
memory/4464-115-0x00000201448E0000-0x00000201448F0000-memory.dmp
memory/4464-114-0x0000020144840000-0x0000020144850000-memory.dmp
memory/4464-36-0x0000020144790000-0x00000201447A0000-memory.dmp
memory/4464-118-0x00000201448F0000-0x0000020144900000-memory.dmp
memory/4464-159-0x0000020144760000-0x0000020144770000-memory.dmp
memory/4464-120-0x0000020144860000-0x0000020144870000-memory.dmp
memory/4464-126-0x0000020144910000-0x0000020144920000-memory.dmp
memory/4464-125-0x0000020144870000-0x0000020144880000-memory.dmp
memory/4464-128-0x0000020144880000-0x0000020144890000-memory.dmp
memory/4464-129-0x0000020144920000-0x0000020144930000-memory.dmp
memory/4464-132-0x0000020144890000-0x00000201448A0000-memory.dmp
memory/4464-135-0x0000020144930000-0x0000020144940000-memory.dmp
memory/4464-134-0x00000201448A0000-0x00000201448B0000-memory.dmp
memory/4464-139-0x00000201448B0000-0x00000201448C0000-memory.dmp
memory/4464-140-0x00000201448C0000-0x00000201448D0000-memory.dmp
memory/4464-141-0x00000201448D0000-0x00000201448E0000-memory.dmp
memory/4464-142-0x0000020142BB0000-0x0000020142BB1000-memory.dmp
memory/4464-145-0x00000201448E0000-0x00000201448F0000-memory.dmp
memory/4464-147-0x00000201448F0000-0x0000020144900000-memory.dmp
memory/4464-148-0x0000020144900000-0x0000020144910000-memory.dmp
memory/4464-152-0x0000020144780000-0x0000020144790000-memory.dmp
memory/4464-161-0x0000020144790000-0x00000201447A0000-memory.dmp
memory/4464-177-0x00000201448E0000-0x00000201448F0000-memory.dmp
memory/4464-176-0x00000201448D0000-0x00000201448E0000-memory.dmp
memory/4464-175-0x00000201448B0000-0x00000201448C0000-memory.dmp
memory/4464-174-0x0000020144860000-0x0000020144870000-memory.dmp
memory/4464-173-0x0000020144830000-0x0000020144840000-memory.dmp
memory/4464-35-0x0000020144490000-0x0000020144700000-memory.dmp
memory/4464-171-0x0000020144820000-0x0000020144830000-memory.dmp
memory/4464-170-0x0000020144810000-0x0000020144820000-memory.dmp
memory/4464-169-0x0000020144800000-0x0000020144810000-memory.dmp
memory/4464-168-0x00000201447E0000-0x00000201447F0000-memory.dmp
memory/4464-167-0x0000020144720000-0x0000020144730000-memory.dmp
memory/4464-166-0x00000201447D0000-0x00000201447E0000-memory.dmp
memory/4464-165-0x00000201447C0000-0x00000201447D0000-memory.dmp
memory/4464-164-0x00000201447B0000-0x00000201447C0000-memory.dmp
memory/4464-163-0x00000201447A0000-0x00000201447B0000-memory.dmp
memory/4464-162-0x0000020144490000-0x0000020144700000-memory.dmp
memory/4464-117-0x0000020144850000-0x0000020144860000-memory.dmp
memory/4464-121-0x0000020144900000-0x0000020144910000-memory.dmp
memory/4464-158-0x0000020144750000-0x0000020144760000-memory.dmp
memory/4464-157-0x0000020144740000-0x0000020144750000-memory.dmp
memory/4464-156-0x0000020144730000-0x0000020144740000-memory.dmp
memory/4464-155-0x00000201447F0000-0x0000020144800000-memory.dmp
memory/4464-154-0x0000020144710000-0x0000020144720000-memory.dmp
memory/4464-153-0x0000020144700000-0x0000020144710000-memory.dmp
memory/4464-25-0x0000020144760000-0x0000020144770000-memory.dmp
memory/4464-21-0x0000020144740000-0x0000020144750000-memory.dmp
memory/4464-23-0x0000020142BB0000-0x0000020142BB1000-memory.dmp
memory/4464-22-0x0000020144750000-0x0000020144760000-memory.dmp
memory/4464-17-0x0000020144720000-0x0000020144730000-memory.dmp
memory/4464-12-0x0000020144700000-0x0000020144710000-memory.dmp
memory/4464-18-0x0000020144730000-0x0000020144740000-memory.dmp
memory/4464-14-0x0000020144710000-0x0000020144720000-memory.dmp
memory/4512-201-0x0000022F45110000-0x0000022F45111000-memory.dmp