Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
16/10/2024, 05:06
General
- Target Telex-copy-pdf.jar
- Size 559KB
- Sample241016-frqaqayanj
- SHA256 9ea17585514dd3c67c40965ed9a96bddea86fcd903230ba306767cb313f7819b
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Telex-copy-pdf.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\Telex-copy-pdf.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Telex-copy-pdf.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Telex-copy-pdf.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Telex-copy-pdf.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna7836056163186198840.dll
83aa4cc77f591dfc2374580bbd95f6ba_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351
Telex-copy-pdf.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/904-244-0x00000231B7B30000-0x00000231B7B31000-memory.dmp
memory/1264-298-0x000001D14F220000-0x000001D14F221000-memory.dmp
memory/4016-95-0x000001EAC3AA0000-0x000001EAC3AB0000-memory.dmp
memory/4016-64-0x000001EAC3B00000-0x000001EAC3B10000-memory.dmp
memory/4016-21-0x000001EAC3A10000-0x000001EAC3A20000-memory.dmp
memory/4016-28-0x000001EAC3A50000-0x000001EAC3A60000-memory.dmp
memory/4016-30-0x000001EAC3A60000-0x000001EAC3A70000-memory.dmp
memory/4016-33-0x000001EAC3A70000-0x000001EAC3A80000-memory.dmp
memory/4016-32-0x000001EAC3760000-0x000001EAC39D0000-memory.dmp
memory/4016-38-0x000001EAC39F0000-0x000001EAC3A00000-memory.dmp
memory/4016-37-0x000001EAC39E0000-0x000001EAC39F0000-memory.dmp
memory/4016-36-0x000001EAC39D0000-0x000001EAC39E0000-memory.dmp
memory/4016-35-0x000001EAC1EC0000-0x000001EAC1EC1000-memory.dmp
memory/4016-39-0x000001EAC3A80000-0x000001EAC3A90000-memory.dmp
memory/4016-47-0x000001EAC3A90000-0x000001EAC3AA0000-memory.dmp
memory/4016-51-0x000001EAC3A20000-0x000001EAC3A30000-memory.dmp
memory/4016-50-0x000001EAC3AA0000-0x000001EAC3AB0000-memory.dmp
memory/4016-49-0x000001EAC3A00000-0x000001EAC3A10000-memory.dmp
memory/4016-48-0x000001EAC3AB0000-0x000001EAC3AC0000-memory.dmp
memory/4016-68-0x000001EAC3A40000-0x000001EAC3A50000-memory.dmp
memory/4016-67-0x000001EAC3A30000-0x000001EAC3A40000-memory.dmp
memory/4016-66-0x000001EAC3B20000-0x000001EAC3B30000-memory.dmp
memory/4016-65-0x000001EAC3B10000-0x000001EAC3B20000-memory.dmp
memory/4016-111-0x000001EAC3B10000-0x000001EAC3B20000-memory.dmp
memory/4016-63-0x000001EAC3AF0000-0x000001EAC3B00000-memory.dmp
memory/4016-62-0x000001EAC3AE0000-0x000001EAC3AF0000-memory.dmp
memory/4016-61-0x000001EAC3AD0000-0x000001EAC3AE0000-memory.dmp
memory/4016-107-0x000001EAC1EC0000-0x000001EAC1EC1000-memory.dmp
memory/4016-53-0x000001EAC3A10000-0x000001EAC3A20000-memory.dmp
memory/4016-72-0x000001EAC3B30000-0x000001EAC3B40000-memory.dmp
memory/4016-73-0x000001EAC1EC0000-0x000001EAC1EC1000-memory.dmp
memory/4016-74-0x000001EAC1EC0000-0x000001EAC1EC1000-memory.dmp
memory/4016-77-0x000001EAC3B40000-0x000001EAC3B50000-memory.dmp
memory/4016-76-0x000001EAC3A50000-0x000001EAC3A60000-memory.dmp
memory/4016-81-0x000001EAC3B50000-0x000001EAC3B60000-memory.dmp
memory/4016-80-0x000001EAC3A60000-0x000001EAC3A70000-memory.dmp
memory/4016-84-0x000001EAC3A70000-0x000001EAC3A80000-memory.dmp
memory/4016-87-0x000001EAC3A80000-0x000001EAC3A90000-memory.dmp
memory/4016-86-0x000001EAC3B70000-0x000001EAC3B80000-memory.dmp
memory/4016-85-0x000001EAC3B60000-0x000001EAC3B70000-memory.dmp
memory/4016-91-0x000001EAC3B80000-0x000001EAC3B90000-memory.dmp
memory/4016-89-0x000001EAC3A90000-0x000001EAC3AA0000-memory.dmp
memory/4016-112-0x000001EAC3B20000-0x000001EAC3B30000-memory.dmp
memory/4016-99-0x000001EAC3AC0000-0x000001EAC3AD0000-memory.dmp
memory/4016-98-0x000001EAC3BB0000-0x000001EAC3BC0000-memory.dmp
memory/4016-97-0x000001EAC3BA0000-0x000001EAC3BB0000-memory.dmp
memory/4016-96-0x000001EAC3B90000-0x000001EAC3BA0000-memory.dmp
memory/4016-26-0x000001EAC3A40000-0x000001EAC3A50000-memory.dmp
memory/4016-102-0x000001EAC1EC0000-0x000001EAC1EC1000-memory.dmp
memory/4016-109-0x000001EAC3AF0000-0x000001EAC3B00000-memory.dmp
memory/4016-110-0x000001EAC3B00000-0x000001EAC3B10000-memory.dmp
memory/4016-113-0x000001EAC3BC0000-0x000001EAC3BD0000-memory.dmp
memory/4016-90-0x000001EAC3AB0000-0x000001EAC3AC0000-memory.dmp
memory/4016-22-0x000001EAC3A20000-0x000001EAC3A30000-memory.dmp
memory/4016-54-0x000001EAC3AC0000-0x000001EAC3AD0000-memory.dmp
memory/4016-108-0x000001EAC3AE0000-0x000001EAC3AF0000-memory.dmp
memory/4016-106-0x000001EAC3AD0000-0x000001EAC3AE0000-memory.dmp
memory/4016-118-0x000001EAC3B30000-0x000001EAC3B40000-memory.dmp
memory/4016-117-0x000001EAC3BE0000-0x000001EAC3BF0000-memory.dmp
memory/4016-116-0x000001EAC3BD0000-0x000001EAC3BE0000-memory.dmp
memory/4016-121-0x000001EAC3BF0000-0x000001EAC3C00000-memory.dmp
memory/4016-120-0x000001EAC3B40000-0x000001EAC3B50000-memory.dmp
memory/4016-124-0x000001EAC3C00000-0x000001EAC3C10000-memory.dmp
memory/4016-123-0x000001EAC3B50000-0x000001EAC3B60000-memory.dmp
memory/4016-128-0x000001EAC3C10000-0x000001EAC3C20000-memory.dmp
memory/4016-127-0x000001EAC3B70000-0x000001EAC3B80000-memory.dmp
memory/4016-126-0x000001EAC3B60000-0x000001EAC3B70000-memory.dmp
memory/4016-131-0x000001EAC3C20000-0x000001EAC3C30000-memory.dmp
memory/4016-132-0x000001EAC1EC0000-0x000001EAC1EC1000-memory.dmp
memory/4016-137-0x000001EAC3B80000-0x000001EAC3B90000-memory.dmp
memory/4016-138-0x000001EAC3C30000-0x000001EAC3C40000-memory.dmp
memory/4016-143-0x000001EAC3C40000-0x000001EAC3C50000-memory.dmp
memory/4016-141-0x000001EAC3BA0000-0x000001EAC3BB0000-memory.dmp
memory/4016-140-0x000001EAC3B90000-0x000001EAC3BA0000-memory.dmp
memory/4016-142-0x000001EAC3BB0000-0x000001EAC3BC0000-memory.dmp
memory/4016-145-0x000001EAC3C50000-0x000001EAC3C60000-memory.dmp
memory/4016-150-0x000001EAC3C60000-0x000001EAC3C70000-memory.dmp
memory/4016-149-0x000001EAC3BC0000-0x000001EAC3BD0000-memory.dmp
memory/4016-153-0x000001EAC1EC0000-0x000001EAC1EC1000-memory.dmp
memory/4016-157-0x000001EAC3BE0000-0x000001EAC3BF0000-memory.dmp
memory/4016-156-0x000001EAC3BD0000-0x000001EAC3BE0000-memory.dmp
memory/4016-159-0x000001EAC3BF0000-0x000001EAC3C00000-memory.dmp
memory/4016-162-0x000001EAC1EC0000-0x000001EAC1EC1000-memory.dmp
memory/4016-170-0x000001EAC3A30000-0x000001EAC3A40000-memory.dmp
memory/4016-179-0x000001EAC3AC0000-0x000001EAC3AD0000-memory.dmp
memory/4016-178-0x000001EAC3A20000-0x000001EAC3A30000-memory.dmp
memory/4016-177-0x000001EAC3AB0000-0x000001EAC3AC0000-memory.dmp
memory/4016-176-0x000001EAC3A90000-0x000001EAC3AA0000-memory.dmp
memory/4016-175-0x000001EAC3A80000-0x000001EAC3A90000-memory.dmp
memory/4016-174-0x000001EAC3A70000-0x000001EAC3A80000-memory.dmp
memory/4016-173-0x000001EAC3A60000-0x000001EAC3A70000-memory.dmp
memory/4016-172-0x000001EAC3A50000-0x000001EAC3A60000-memory.dmp
memory/4016-171-0x000001EAC3A40000-0x000001EAC3A50000-memory.dmp
memory/4016-169-0x000001EAC3AA0000-0x000001EAC3AB0000-memory.dmp
memory/4016-168-0x000001EAC3A10000-0x000001EAC3A20000-memory.dmp
memory/4016-167-0x000001EAC3A00000-0x000001EAC3A10000-memory.dmp
memory/4016-25-0x000001EAC3A30000-0x000001EAC3A40000-memory.dmp
memory/4016-18-0x000001EAC3A00000-0x000001EAC3A10000-memory.dmp
memory/4016-15-0x000001EAC39E0000-0x000001EAC39F0000-memory.dmp
memory/4016-14-0x000001EAC39D0000-0x000001EAC39E0000-memory.dmp
memory/4016-16-0x000001EAC39F0000-0x000001EAC3A00000-memory.dmp
memory/4016-2-0x000001EAC3760000-0x000001EAC39D0000-memory.dmp
memory/4016-166-0x000001EAC39F0000-0x000001EAC3A00000-memory.dmp
memory/4016-165-0x000001EAC39E0000-0x000001EAC39F0000-memory.dmp
memory/4016-164-0x000001EAC39D0000-0x000001EAC39E0000-memory.dmp
memory/4016-163-0x000001EAC3760000-0x000001EAC39D0000-memory.dmp