Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
21/10/2024, 01:57
General
- Target fa454076cf36fe6868d54215ebb345cd9d6c8423fa9bd9f0bd56df9074915215.jar
- Size 88KB
- Sample241021-cdrd3svdmn
- SHA256 fa454076cf36fe6868d54215ebb345cd9d6c8423fa9bd9f0bd56df9074915215
Malware Config
Extracted
-
strrat
-
194.5.98.243:7123
-
194.5.98.243:7234
-
license_id
FREF-6ILG-J2DN-PT5K-AYC2
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\fa454076cf36fe6868d54215ebb345cd9d6c8423fa9bd9f0bd56df9074915215.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\fa454076cf36fe6868d54215ebb345cd9d6c8423fa9bd9f0bd56df9074915215.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\fa454076cf36fe6868d54215ebb345cd9d6c8423fa9bd9f0bd56df9074915215.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\fa454076cf36fe6868d54215ebb345cd9d6c8423fa9bd9f0bd56df9074915215.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\fa454076cf36fe6868d54215ebb345cd9d6c8423fa9bd9f0bd56df9074915215.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna1771981829808301312.dll
83aa4cc77f591dfc2374580bbd95f6ba_4304acb9-c3f6-452a-9860-eb4e85d38d4e
fa454076cf36fe6868d54215ebb345cd9d6c8423fa9bd9f0bd56df9074915215.jar
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1736-247-0x0000020066960000-0x0000020066961000-memory.dmp
memory/1736-217-0x0000020066960000-0x0000020066961000-memory.dmp
memory/4408-105-0x0000014A0F690000-0x0000014A0F6A0000-memory.dmp
memory/4408-158-0x0000014A0F530000-0x0000014A0F540000-memory.dmp
memory/4408-27-0x0000014A0F520000-0x0000014A0F530000-memory.dmp
memory/4408-33-0x0000014A0F530000-0x0000014A0F540000-memory.dmp
memory/4408-39-0x0000014A0D970000-0x0000014A0D971000-memory.dmp
memory/4408-42-0x0000014A0F560000-0x0000014A0F570000-memory.dmp
memory/4408-41-0x0000014A0F4C0000-0x0000014A0F4D0000-memory.dmp
memory/4408-38-0x0000014A0F4B0000-0x0000014A0F4C0000-memory.dmp
memory/4408-45-0x0000014A0F570000-0x0000014A0F580000-memory.dmp
memory/4408-44-0x0000014A0F4D0000-0x0000014A0F4E0000-memory.dmp
memory/4408-37-0x0000014A0F550000-0x0000014A0F560000-memory.dmp
memory/4408-36-0x0000014A0F540000-0x0000014A0F550000-memory.dmp
memory/4408-35-0x0000014A0F240000-0x0000014A0F4B0000-memory.dmp
memory/4408-49-0x0000014A0F580000-0x0000014A0F590000-memory.dmp
memory/4408-48-0x0000014A0F4E0000-0x0000014A0F4F0000-memory.dmp
memory/4408-52-0x0000014A0F590000-0x0000014A0F5A0000-memory.dmp
memory/4408-51-0x0000014A0F500000-0x0000014A0F510000-memory.dmp
memory/4408-50-0x0000014A0F4F0000-0x0000014A0F500000-memory.dmp
memory/4408-55-0x0000014A0F5A0000-0x0000014A0F5B0000-memory.dmp
memory/4408-57-0x0000014A0F5B0000-0x0000014A0F5C0000-memory.dmp
memory/4408-56-0x0000014A0F510000-0x0000014A0F520000-memory.dmp
memory/4408-61-0x0000014A0F5C0000-0x0000014A0F5D0000-memory.dmp
memory/4408-60-0x0000014A0F520000-0x0000014A0F530000-memory.dmp
memory/4408-65-0x0000014A0F5D0000-0x0000014A0F5E0000-memory.dmp
memory/4408-64-0x0000014A0F530000-0x0000014A0F540000-memory.dmp
memory/4408-66-0x0000014A0D970000-0x0000014A0D971000-memory.dmp
memory/4408-70-0x0000014A0F5E0000-0x0000014A0F5F0000-memory.dmp
memory/4408-69-0x0000014A0F540000-0x0000014A0F550000-memory.dmp
memory/4408-77-0x0000014A0F560000-0x0000014A0F570000-memory.dmp
memory/4408-76-0x0000014A0F600000-0x0000014A0F610000-memory.dmp
memory/4408-75-0x0000014A0F5F0000-0x0000014A0F600000-memory.dmp
memory/4408-74-0x0000014A0F550000-0x0000014A0F560000-memory.dmp
memory/4408-82-0x0000014A0F570000-0x0000014A0F580000-memory.dmp
memory/4408-87-0x0000014A0F580000-0x0000014A0F590000-memory.dmp
memory/4408-86-0x0000014A0F640000-0x0000014A0F650000-memory.dmp
memory/4408-85-0x0000014A0F630000-0x0000014A0F640000-memory.dmp
memory/4408-84-0x0000014A0F620000-0x0000014A0F630000-memory.dmp
memory/4408-83-0x0000014A0F610000-0x0000014A0F620000-memory.dmp
memory/4408-92-0x0000014A0F650000-0x0000014A0F660000-memory.dmp
memory/4408-91-0x0000014A0F590000-0x0000014A0F5A0000-memory.dmp
memory/4408-95-0x0000014A0F660000-0x0000014A0F670000-memory.dmp
memory/4408-94-0x0000014A0F5A0000-0x0000014A0F5B0000-memory.dmp
memory/4408-98-0x0000014A0F5B0000-0x0000014A0F5C0000-memory.dmp
memory/4408-99-0x0000014A0F670000-0x0000014A0F680000-memory.dmp
memory/4408-100-0x0000014A0D970000-0x0000014A0D971000-memory.dmp
memory/4408-21-0x0000014A0F4F0000-0x0000014A0F500000-memory.dmp
memory/4408-106-0x0000014A0F5D0000-0x0000014A0F5E0000-memory.dmp
memory/4408-104-0x0000014A0F680000-0x0000014A0F690000-memory.dmp
memory/4408-109-0x0000014A0F6A0000-0x0000014A0F6B0000-memory.dmp
memory/4408-108-0x0000014A0F5E0000-0x0000014A0F5F0000-memory.dmp
memory/4408-25-0x0000014A0F510000-0x0000014A0F520000-memory.dmp
memory/4408-103-0x0000014A0F5C0000-0x0000014A0F5D0000-memory.dmp
memory/4408-157-0x0000014A0F520000-0x0000014A0F530000-memory.dmp
memory/4408-117-0x0000014A0F6B0000-0x0000014A0F6C0000-memory.dmp
memory/4408-116-0x0000014A0F600000-0x0000014A0F610000-memory.dmp
memory/4408-119-0x0000014A0F6C0000-0x0000014A0F6D0000-memory.dmp
memory/4408-124-0x0000014A0F620000-0x0000014A0F630000-memory.dmp
memory/4408-127-0x0000014A0F6D0000-0x0000014A0F6E0000-memory.dmp
memory/4408-126-0x0000014A0F640000-0x0000014A0F650000-memory.dmp
memory/4408-125-0x0000014A0F630000-0x0000014A0F640000-memory.dmp
memory/4408-123-0x0000014A0F610000-0x0000014A0F620000-memory.dmp
memory/4408-130-0x0000014A0F6E0000-0x0000014A0F6F0000-memory.dmp
memory/4408-133-0x0000014A0F650000-0x0000014A0F660000-memory.dmp
memory/4408-134-0x0000014A0F6F0000-0x0000014A0F700000-memory.dmp
memory/4408-135-0x0000014A0D970000-0x0000014A0D971000-memory.dmp
memory/4408-138-0x0000014A0F660000-0x0000014A0F670000-memory.dmp
memory/4408-140-0x0000014A0F670000-0x0000014A0F680000-memory.dmp
memory/4408-145-0x0000014A0D970000-0x0000014A0D971000-memory.dmp
memory/4408-149-0x0000014A0F4B0000-0x0000014A0F4C0000-memory.dmp
memory/4408-176-0x0000014A0F660000-0x0000014A0F670000-memory.dmp
memory/4408-175-0x0000014A0F640000-0x0000014A0F650000-memory.dmp
memory/4408-174-0x0000014A0F630000-0x0000014A0F640000-memory.dmp
memory/4408-173-0x0000014A0F620000-0x0000014A0F630000-memory.dmp
memory/4408-172-0x0000014A0F610000-0x0000014A0F620000-memory.dmp
memory/4408-171-0x0000014A0F600000-0x0000014A0F610000-memory.dmp
memory/4408-170-0x0000014A0F5F0000-0x0000014A0F600000-memory.dmp
memory/4408-169-0x0000014A0F5E0000-0x0000014A0F5F0000-memory.dmp
memory/4408-168-0x0000014A0F5D0000-0x0000014A0F5E0000-memory.dmp
memory/4408-167-0x0000014A0F5C0000-0x0000014A0F5D0000-memory.dmp
memory/4408-166-0x0000014A0F5B0000-0x0000014A0F5C0000-memory.dmp
memory/4408-165-0x0000014A0F5A0000-0x0000014A0F5B0000-memory.dmp
memory/4408-164-0x0000014A0F590000-0x0000014A0F5A0000-memory.dmp
memory/4408-163-0x0000014A0F580000-0x0000014A0F590000-memory.dmp
memory/4408-162-0x0000014A0F570000-0x0000014A0F580000-memory.dmp
memory/4408-161-0x0000014A0F560000-0x0000014A0F570000-memory.dmp
memory/4408-159-0x0000014A0F540000-0x0000014A0F550000-memory.dmp
memory/4408-110-0x0000014A0D970000-0x0000014A0D971000-memory.dmp
memory/4408-115-0x0000014A0F5F0000-0x0000014A0F600000-memory.dmp
memory/4408-156-0x0000014A0F510000-0x0000014A0F520000-memory.dmp
memory/4408-155-0x0000014A0F500000-0x0000014A0F510000-memory.dmp
memory/4408-154-0x0000014A0F4F0000-0x0000014A0F500000-memory.dmp
memory/4408-22-0x0000014A0F500000-0x0000014A0F510000-memory.dmp
memory/4408-18-0x0000014A0F4E0000-0x0000014A0F4F0000-memory.dmp
memory/4408-16-0x0000014A0F4D0000-0x0000014A0F4E0000-memory.dmp
memory/4408-14-0x0000014A0F4C0000-0x0000014A0F4D0000-memory.dmp
memory/4408-12-0x0000014A0F4B0000-0x0000014A0F4C0000-memory.dmp
memory/4408-2-0x0000014A0F240000-0x0000014A0F4B0000-memory.dmp
memory/4408-153-0x0000014A0F4E0000-0x0000014A0F4F0000-memory.dmp
memory/4408-152-0x0000014A0F4D0000-0x0000014A0F4E0000-memory.dmp
memory/4408-150-0x0000014A0F4C0000-0x0000014A0F4D0000-memory.dmp
memory/4408-160-0x0000014A0F240000-0x0000014A0F4B0000-memory.dmp
memory/4408-148-0x0000014A0F550000-0x0000014A0F560000-memory.dmp
memory/4852-290-0x00000279B69D0000-0x00000279B69D1000-memory.dmp