Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
15/10/2024, 01:38
General
- Target 67e0dec2524470835e1e336e0113a805125e96b69f7ea4010377e7f03c3f8234.jar
- Size 412KB
- Sample241015-b2tzfa1epm
- SHA256 67e0dec2524470835e1e336e0113a805125e96b69f7ea4010377e7f03c3f8234
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\67e0dec2524470835e1e336e0113a805125e96b69f7ea4010377e7f03c3f8234.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\67e0dec2524470835e1e336e0113a805125e96b69f7ea4010377e7f03c3f8234.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\67e0dec2524470835e1e336e0113a805125e96b69f7ea4010377e7f03c3f8234.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\67e0dec2524470835e1e336e0113a805125e96b69f7ea4010377e7f03c3f8234.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\67e0dec2524470835e1e336e0113a805125e96b69f7ea4010377e7f03c3f8234.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
67e0dec2524470835e1e336e0113a805125e96b69f7ea4010377e7f03c3f8234.jar
jna7547069913917608956.dll
83aa4cc77f591dfc2374580bbd95f6ba_a4172161-d53d-48af-8f36-a00b057e74d4
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1236-105-0x0000016D51D10000-0x0000016D51D20000-memory.dmp
memory/1236-73-0x0000016D51CC0000-0x0000016D51CD0000-memory.dmp
memory/1236-24-0x0000016D51C70000-0x0000016D51C80000-memory.dmp
memory/1236-23-0x0000016D51C60000-0x0000016D51C70000-memory.dmp
memory/1236-29-0x0000016D51C90000-0x0000016D51CA0000-memory.dmp
memory/1236-28-0x0000016D51C80000-0x0000016D51C90000-memory.dmp
memory/1236-32-0x0000016D519A0000-0x0000016D51C10000-memory.dmp
memory/1236-33-0x0000016D51CA0000-0x0000016D51CB0000-memory.dmp
memory/1236-31-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-36-0x0000016D51CB0000-0x0000016D51CC0000-memory.dmp
memory/1236-35-0x0000016D51C20000-0x0000016D51C30000-memory.dmp
memory/1236-34-0x0000016D51C10000-0x0000016D51C20000-memory.dmp
memory/1236-43-0x0000016D51CC0000-0x0000016D51CD0000-memory.dmp
memory/1236-42-0x0000016D51C30000-0x0000016D51C40000-memory.dmp
memory/1236-45-0x0000016D51CD0000-0x0000016D51CE0000-memory.dmp
memory/1236-51-0x0000016D51C50000-0x0000016D51C60000-memory.dmp
memory/1236-50-0x0000016D51CF0000-0x0000016D51D00000-memory.dmp
memory/1236-49-0x0000016D51CE0000-0x0000016D51CF0000-memory.dmp
memory/1236-48-0x0000016D51C40000-0x0000016D51C50000-memory.dmp
memory/1236-54-0x0000016D51D00000-0x0000016D51D10000-memory.dmp
memory/1236-112-0x0000016D51D40000-0x0000016D51D50000-memory.dmp
memory/1236-61-0x0000016D51C90000-0x0000016D51CA0000-memory.dmp
memory/1236-60-0x0000016D51C80000-0x0000016D51C90000-memory.dmp
memory/1236-63-0x0000016D51D30000-0x0000016D51D40000-memory.dmp
memory/1236-66-0x0000016D51D40000-0x0000016D51D50000-memory.dmp
memory/1236-65-0x0000016D51CA0000-0x0000016D51CB0000-memory.dmp
memory/1236-59-0x0000016D51D20000-0x0000016D51D30000-memory.dmp
memory/1236-58-0x0000016D51D10000-0x0000016D51D20000-memory.dmp
memory/1236-57-0x0000016D51C70000-0x0000016D51C80000-memory.dmp
memory/1236-71-0x0000016D51D50000-0x0000016D51D60000-memory.dmp
memory/1236-70-0x0000016D51CB0000-0x0000016D51CC0000-memory.dmp
memory/1236-113-0x0000016D51E10000-0x0000016D51E20000-memory.dmp
memory/1236-74-0x0000016D51D60000-0x0000016D51D70000-memory.dmp
memory/1236-75-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-76-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-83-0x0000016D51D70000-0x0000016D51D80000-memory.dmp
memory/1236-93-0x0000016D51DB0000-0x0000016D51DC0000-memory.dmp
memory/1236-95-0x0000016D51DD0000-0x0000016D51DE0000-memory.dmp
memory/1236-92-0x0000016D51DA0000-0x0000016D51DB0000-memory.dmp
memory/1236-91-0x0000016D51CF0000-0x0000016D51D00000-memory.dmp
memory/1236-90-0x0000016D51CE0000-0x0000016D51CF0000-memory.dmp
memory/1236-89-0x0000016D51D80000-0x0000016D51D90000-memory.dmp
memory/1236-88-0x0000016D51DC0000-0x0000016D51DD0000-memory.dmp
memory/1236-87-0x0000016D51D90000-0x0000016D51DA0000-memory.dmp
memory/1236-109-0x0000016D51E00000-0x0000016D51E10000-memory.dmp
memory/1236-96-0x0000016D51D00000-0x0000016D51D10000-memory.dmp
memory/1236-101-0x0000016D51DE0000-0x0000016D51DF0000-memory.dmp
memory/1236-102-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-106-0x0000016D51DF0000-0x0000016D51E00000-memory.dmp
memory/1236-18-0x0000016D51C40000-0x0000016D51C50000-memory.dmp
memory/1236-104-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-108-0x0000016D51D20000-0x0000016D51D30000-memory.dmp
memory/1236-81-0x0000016D51CD0000-0x0000016D51CE0000-memory.dmp
memory/1236-20-0x0000016D51C50000-0x0000016D51C60000-memory.dmp
memory/1236-53-0x0000016D51C60000-0x0000016D51C70000-memory.dmp
memory/1236-111-0x0000016D51D30000-0x0000016D51D40000-memory.dmp
memory/1236-117-0x0000016D51E20000-0x0000016D51E30000-memory.dmp
memory/1236-115-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-118-0x0000016D51D50000-0x0000016D51D60000-memory.dmp
memory/1236-119-0x0000016D51E30000-0x0000016D51E40000-memory.dmp
memory/1236-124-0x0000016D51E40000-0x0000016D51E50000-memory.dmp
memory/1236-123-0x0000016D51D90000-0x0000016D51DA0000-memory.dmp
memory/1236-122-0x0000016D51D60000-0x0000016D51D70000-memory.dmp
memory/1236-126-0x0000016D51D70000-0x0000016D51D80000-memory.dmp
memory/1236-128-0x0000016D51E50000-0x0000016D51E60000-memory.dmp
memory/1236-127-0x0000016D51DC0000-0x0000016D51DD0000-memory.dmp
memory/1236-133-0x0000016D51E60000-0x0000016D51E70000-memory.dmp
memory/1236-132-0x0000016D51DB0000-0x0000016D51DC0000-memory.dmp
memory/1236-131-0x0000016D51DA0000-0x0000016D51DB0000-memory.dmp
memory/1236-130-0x0000016D51D80000-0x0000016D51D90000-memory.dmp
memory/1236-135-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-139-0x0000016D51DD0000-0x0000016D51DE0000-memory.dmp
memory/1236-140-0x0000016D51E70000-0x0000016D51E80000-memory.dmp
memory/1236-145-0x0000016D51E80000-0x0000016D51E90000-memory.dmp
memory/1236-144-0x0000016D51DE0000-0x0000016D51DF0000-memory.dmp
memory/1236-148-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-149-0x0000016D51DF0000-0x0000016D51E00000-memory.dmp
memory/1236-153-0x0000016D51E00000-0x0000016D51E10000-memory.dmp
memory/1236-154-0x0000016D51E10000-0x0000016D51E20000-memory.dmp
memory/1236-157-0x0000016D50190000-0x0000016D50191000-memory.dmp
memory/1236-178-0x0000016D51CD0000-0x0000016D51CE0000-memory.dmp
memory/1236-177-0x0000016D51D60000-0x0000016D51D70000-memory.dmp
memory/1236-176-0x0000016D51D50000-0x0000016D51D60000-memory.dmp
memory/1236-175-0x0000016D51C70000-0x0000016D51C80000-memory.dmp
memory/1236-174-0x0000016D51D10000-0x0000016D51D20000-memory.dmp
memory/1236-173-0x0000016D51D00000-0x0000016D51D10000-memory.dmp
memory/1236-172-0x0000016D51CF0000-0x0000016D51D00000-memory.dmp
memory/1236-171-0x0000016D51CE0000-0x0000016D51CF0000-memory.dmp
memory/1236-170-0x0000016D51CC0000-0x0000016D51CD0000-memory.dmp
memory/1236-169-0x0000016D51CB0000-0x0000016D51CC0000-memory.dmp
memory/1236-168-0x0000016D51CA0000-0x0000016D51CB0000-memory.dmp
memory/1236-167-0x0000016D51C90000-0x0000016D51CA0000-memory.dmp
memory/1236-166-0x0000016D51C80000-0x0000016D51C90000-memory.dmp
memory/1236-165-0x0000016D51C20000-0x0000016D51C30000-memory.dmp
memory/1236-164-0x0000016D51C60000-0x0000016D51C70000-memory.dmp
memory/1236-163-0x0000016D51C50000-0x0000016D51C60000-memory.dmp
memory/1236-162-0x0000016D51C40000-0x0000016D51C50000-memory.dmp
memory/1236-15-0x0000016D51C20000-0x0000016D51C30000-memory.dmp
memory/1236-159-0x0000016D51C10000-0x0000016D51C20000-memory.dmp
memory/1236-161-0x0000016D51C30000-0x0000016D51C40000-memory.dmp
memory/1236-160-0x0000016D51D20000-0x0000016D51D30000-memory.dmp
memory/1236-158-0x0000016D519A0000-0x0000016D51C10000-memory.dmp
memory/1236-2-0x0000016D519A0000-0x0000016D51C10000-memory.dmp
memory/1236-16-0x0000016D51C30000-0x0000016D51C40000-memory.dmp
memory/1236-13-0x0000016D51C10000-0x0000016D51C20000-memory.dmp
memory/1468-278-0x00000280B76A0000-0x00000280B76A1000-memory.dmp
memory/1468-290-0x00000280B76A0000-0x00000280B76A1000-memory.dmp
memory/4920-231-0x0000022600510000-0x0000022600511000-memory.dmp