Analysis
- max time kernel
140s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/10/2024, 09:06
General
- Target CLOdeCLientV3.jar
- Size 639KB
- Sample241020-k2saaazepf
- SHA256 bb75ca9e8f6074ecaf8eabe0f80e309e92d86f244921d8d316bf8dc67249e52c
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\CLOdeCLientV3.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729415174494.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729415174494.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5056-2-0x0000029723480000-0x00000297236F0000-memory.dmp
memory/5056-15-0x00000297236F0000-0x0000029723700000-memory.dmp
memory/5056-17-0x0000029723700000-0x0000029723710000-memory.dmp
memory/5056-19-0x0000029723710000-0x0000029723720000-memory.dmp
memory/5056-21-0x0000029723720000-0x0000029723730000-memory.dmp
memory/5056-23-0x0000029723730000-0x0000029723740000-memory.dmp
memory/5056-25-0x0000029723740000-0x0000029723750000-memory.dmp
memory/5056-27-0x0000029723750000-0x0000029723760000-memory.dmp
memory/5056-29-0x0000029721C40000-0x0000029721C41000-memory.dmp
memory/5056-31-0x0000029723760000-0x0000029723770000-memory.dmp
memory/5056-34-0x0000029721C40000-0x0000029721C41000-memory.dmp
memory/5056-35-0x0000029723480000-0x00000297236F0000-memory.dmp
memory/5056-36-0x00000297236F0000-0x0000029723700000-memory.dmp
memory/5056-38-0x0000029723700000-0x0000029723710000-memory.dmp
memory/5056-39-0x0000029723710000-0x0000029723720000-memory.dmp
memory/5056-40-0x0000029723720000-0x0000029723730000-memory.dmp
memory/5056-41-0x0000029723730000-0x0000029723740000-memory.dmp
memory/5056-42-0x0000029723740000-0x0000029723750000-memory.dmp
memory/5056-43-0x0000029723750000-0x0000029723760000-memory.dmp
memory/5056-44-0x0000029723760000-0x0000029723770000-memory.dmp
memory/5056-47-0x0000029723770000-0x0000029723780000-memory.dmp
memory/5056-48-0x0000029721C40000-0x0000029721C41000-memory.dmp
memory/5056-49-0x0000029723770000-0x0000029723780000-memory.dmp
memory/5056-51-0x0000029723780000-0x0000029723790000-memory.dmp
memory/5056-52-0x0000029723780000-0x0000029723790000-memory.dmp