Analysis
- max time kernel
135s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
24/10/2024, 02:15
General
- Target cc60fd66292a5edd37d23b5f3928015bd7aefa106df32d27adfe0604564ca682.js
- Size 199KB
- Sample241024-cpnsbsscmj
- SHA256 cc60fd66292a5edd37d23b5f3928015bd7aefa106df32d27adfe0604564ca682
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\cc60fd66292a5edd37d23b5f3928015bd7aefa106df32d27adfe0604564ca682.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\vsyowvf.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\vsyowvf.txt"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\vsyowvf.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\vsyowvf.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\vsyowvf.txt"4⤵
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
jna7359928056903715562.dll
83aa4cc77f591dfc2374580bbd95f6ba_a4172161-d53d-48af-8f36-a00b057e74d4
vsyowvf.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/2004-103-0x0000022000360000-0x0000022000370000-memory.dmp
memory/2004-122-0x0000022000490000-0x00000220004A0000-memory.dmp
memory/2004-52-0x00000220002B0000-0x00000220002C0000-memory.dmp
memory/2004-62-0x0000022000380000-0x0000022000390000-memory.dmp
memory/2004-61-0x00000220002E0000-0x00000220002F0000-memory.dmp
memory/2004-59-0x00000220002D0000-0x00000220002E0000-memory.dmp
memory/2004-60-0x0000022000370000-0x0000022000380000-memory.dmp
memory/2004-57-0x0000022000360000-0x0000022000370000-memory.dmp
memory/2004-56-0x00000220002C0000-0x00000220002D0000-memory.dmp
memory/2004-53-0x0000022000350000-0x0000022000360000-memory.dmp
memory/2004-68-0x0000022075D80000-0x0000022075D81000-memory.dmp
memory/2004-71-0x00000220003A0000-0x00000220003B0000-memory.dmp
memory/2004-70-0x0000022000300000-0x0000022000310000-memory.dmp
memory/2004-76-0x00000220003B0000-0x00000220003C0000-memory.dmp
memory/2004-90-0x0000022000410000-0x0000022000420000-memory.dmp
memory/2004-89-0x0000022000400000-0x0000022000410000-memory.dmp
memory/2004-88-0x00000220003F0000-0x0000022000400000-memory.dmp
memory/2004-95-0x0000022075D80000-0x0000022075D81000-memory.dmp
memory/2004-101-0x0000022000430000-0x0000022000440000-memory.dmp
memory/2004-104-0x0000022000440000-0x0000022000450000-memory.dmp
memory/2004-35-0x00000220002F0000-0x0000022000300000-memory.dmp
memory/2004-100-0x0000022000350000-0x0000022000360000-memory.dmp
memory/2004-105-0x0000022075D80000-0x0000022075D81000-memory.dmp
memory/2004-108-0x0000022000450000-0x0000022000460000-memory.dmp
memory/2004-107-0x0000022000370000-0x0000022000380000-memory.dmp
memory/2004-111-0x0000022000460000-0x0000022000470000-memory.dmp
memory/2004-114-0x0000022000470000-0x0000022000480000-memory.dmp
memory/2004-113-0x0000022000390000-0x00000220003A0000-memory.dmp
memory/2004-117-0x0000022000480000-0x0000022000490000-memory.dmp
memory/2004-116-0x00000220003A0000-0x00000220003B0000-memory.dmp
memory/2004-66-0x00000220002F0000-0x0000022000300000-memory.dmp
memory/2004-126-0x00000220003F0000-0x0000022000400000-memory.dmp
memory/2004-127-0x0000022000400000-0x0000022000410000-memory.dmp
memory/2004-125-0x00000220003E0000-0x00000220003F0000-memory.dmp
memory/2004-124-0x00000220003C0000-0x00000220003D0000-memory.dmp
memory/2004-130-0x00000220004A0000-0x00000220004B0000-memory.dmp
memory/2004-129-0x0000022000410000-0x0000022000420000-memory.dmp
memory/2004-133-0x0000022075D80000-0x0000022075D81000-memory.dmp
memory/2004-136-0x0000022000420000-0x0000022000430000-memory.dmp
memory/2004-137-0x00000220004B0000-0x00000220004C0000-memory.dmp
memory/2004-123-0x0000022000490000-0x00000220004A0000-memory.dmp
memory/2004-121-0x00000220003D0000-0x00000220003E0000-memory.dmp
memory/2004-67-0x0000022000390000-0x00000220003A0000-memory.dmp
memory/2004-110-0x0000022000380000-0x0000022000390000-memory.dmp
memory/2004-99-0x0000022000420000-0x0000022000430000-memory.dmp
memory/2004-98-0x0000022000340000-0x0000022000350000-memory.dmp
memory/2004-87-0x00000220003E0000-0x00000220003F0000-memory.dmp
memory/2004-85-0x00000220003C0000-0x00000220003D0000-memory.dmp
memory/2004-84-0x0000022000330000-0x0000022000340000-memory.dmp
memory/2004-86-0x00000220003D0000-0x00000220003E0000-memory.dmp
memory/2004-83-0x0000022000320000-0x0000022000330000-memory.dmp
memory/2004-75-0x0000022000310000-0x0000022000320000-memory.dmp
memory/2004-120-0x00000220003B0000-0x00000220003C0000-memory.dmp
memory/2004-45-0x0000022000320000-0x0000022000330000-memory.dmp
memory/2004-50-0x0000022000340000-0x0000022000350000-memory.dmp
memory/2004-48-0x00000220002A0000-0x00000220002B0000-memory.dmp
memory/2004-47-0x0000022000290000-0x00000220002A0000-memory.dmp
memory/2004-46-0x0000022000330000-0x0000022000340000-memory.dmp
memory/2004-145-0x0000022000430000-0x0000022000440000-memory.dmp
memory/2004-144-0x0000022075D80000-0x0000022075D81000-memory.dmp
memory/2004-44-0x0000022000280000-0x0000022000290000-memory.dmp
memory/2004-41-0x0000022000310000-0x0000022000320000-memory.dmp
memory/2004-40-0x0000022000270000-0x0000022000280000-memory.dmp
memory/2004-39-0x0000022000300000-0x0000022000310000-memory.dmp
memory/2004-38-0x0000022000000000-0x0000022000270000-memory.dmp
memory/2004-25-0x00000220002C0000-0x00000220002D0000-memory.dmp
memory/2004-20-0x00000220002A0000-0x00000220002B0000-memory.dmp
memory/2004-19-0x0000022000290000-0x00000220002A0000-memory.dmp
memory/2004-147-0x0000022000440000-0x0000022000450000-memory.dmp
memory/2004-148-0x0000022000450000-0x0000022000460000-memory.dmp
memory/2004-152-0x0000022000000000-0x0000022000270000-memory.dmp
memory/2004-177-0x0000022000480000-0x0000022000490000-memory.dmp
memory/2004-176-0x0000022000470000-0x0000022000480000-memory.dmp
memory/2004-29-0x0000022075D80000-0x0000022075D81000-memory.dmp
memory/2004-28-0x00000220002E0000-0x00000220002F0000-memory.dmp
memory/2004-27-0x00000220002D0000-0x00000220002E0000-memory.dmp
memory/2004-23-0x00000220002B0000-0x00000220002C0000-memory.dmp
memory/2004-14-0x0000022000270000-0x0000022000280000-memory.dmp
memory/2004-175-0x0000022000460000-0x0000022000470000-memory.dmp
memory/2004-173-0x0000022000400000-0x0000022000410000-memory.dmp
memory/2004-172-0x00000220003E0000-0x00000220003F0000-memory.dmp
memory/2004-171-0x0000022000410000-0x0000022000420000-memory.dmp
memory/2004-170-0x00000220003A0000-0x00000220003B0000-memory.dmp
memory/2004-169-0x0000022000370000-0x0000022000380000-memory.dmp
memory/2004-168-0x0000022000360000-0x0000022000370000-memory.dmp
memory/2004-16-0x0000022000280000-0x0000022000290000-memory.dmp
memory/2004-151-0x0000022075D80000-0x0000022075D81000-memory.dmp
memory/2004-4-0x0000022000000000-0x0000022000270000-memory.dmp
memory/2004-167-0x0000022000350000-0x0000022000360000-memory.dmp
memory/2004-153-0x0000022000270000-0x0000022000280000-memory.dmp
memory/2004-154-0x0000022000280000-0x0000022000290000-memory.dmp
memory/2004-166-0x0000022000340000-0x0000022000350000-memory.dmp
memory/2004-165-0x0000022000330000-0x0000022000340000-memory.dmp
memory/2004-164-0x0000022000320000-0x0000022000330000-memory.dmp
memory/2004-163-0x0000022000310000-0x0000022000320000-memory.dmp
memory/2004-162-0x0000022000300000-0x0000022000310000-memory.dmp
memory/2004-161-0x00000220002F0000-0x0000022000300000-memory.dmp
memory/2004-160-0x00000220002E0000-0x00000220002F0000-memory.dmp
memory/2004-159-0x00000220002D0000-0x00000220002E0000-memory.dmp
memory/2004-158-0x00000220002C0000-0x00000220002D0000-memory.dmp
memory/2004-157-0x00000220002B0000-0x00000220002C0000-memory.dmp
memory/2004-156-0x00000220002A0000-0x00000220002B0000-memory.dmp
memory/2004-155-0x0000022000290000-0x00000220002A0000-memory.dmp
memory/4256-261-0x00000240182E0000-0x00000240182E1000-memory.dmp
memory/4276-228-0x0000020D406D0000-0x0000020D406D1000-memory.dmp
memory/4276-213-0x0000020D406D0000-0x0000020D406D1000-memory.dmp