Analysis
- max time kernel
124s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
26/11/2024, 02:48
General
- Target 8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78.jar
- Size 264KB
- Sample241126-day57azpgx
- SHA256 8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78
Malware Config
Extracted
-
strrat
-
badmiles.ddns.net:5055
-
license_id
4OI0-V4TA-Z8G4-WQF1-B9VH
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Strrat family
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78.jar
jna5825255355784605602.dll
83aa4cc77f591dfc2374580bbd95f6ba_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/776-261-0x0000021C01EC0000-0x0000021C01EC1000-memory.dmp
memory/1596-220-0x0000016643790000-0x0000016643791000-memory.dmp
memory/4560-100-0x000002B0EB810000-0x000002B0EB820000-memory.dmp
memory/4560-64-0x000002B0EB850000-0x000002B0EB860000-memory.dmp
memory/4560-26-0x000002B0EB780000-0x000002B0EB790000-memory.dmp
memory/4560-27-0x000002B0EB790000-0x000002B0EB7A0000-memory.dmp
memory/4560-29-0x000002B0EB7A0000-0x000002B0EB7B0000-memory.dmp
memory/4560-37-0x000002B0EB7B0000-0x000002B0EB7C0000-memory.dmp
memory/4560-39-0x000002B0EB720000-0x000002B0EB730000-memory.dmp
memory/4560-38-0x000002B0EB7C0000-0x000002B0EB7D0000-memory.dmp
memory/4560-36-0x000002B0EB4B0000-0x000002B0EB720000-memory.dmp
memory/4560-45-0x000002B0EB740000-0x000002B0EB750000-memory.dmp
memory/4560-44-0x000002B0EB7E0000-0x000002B0EB7F0000-memory.dmp
memory/4560-43-0x000002B0EB7D0000-0x000002B0EB7E0000-memory.dmp
memory/4560-42-0x000002B0EB730000-0x000002B0EB740000-memory.dmp
memory/4560-54-0x000002B0EB800000-0x000002B0EB810000-memory.dmp
memory/4560-59-0x000002B0EB760000-0x000002B0EB770000-memory.dmp
memory/4560-58-0x000002B0EB840000-0x000002B0EB850000-memory.dmp
memory/4560-57-0x000002B0EB830000-0x000002B0EB840000-memory.dmp
memory/4560-56-0x000002B0EB820000-0x000002B0EB830000-memory.dmp
memory/4560-55-0x000002B0EB810000-0x000002B0EB820000-memory.dmp
memory/4560-53-0x000002B0EB7F0000-0x000002B0EB800000-memory.dmp
memory/4560-52-0x000002B0EB750000-0x000002B0EB760000-memory.dmp
memory/4560-111-0x000002B0E9BB0000-0x000002B0E9BB1000-memory.dmp
memory/4560-63-0x000002B0EB770000-0x000002B0EB780000-memory.dmp
memory/4560-65-0x000002B0E9BB0000-0x000002B0E9BB1000-memory.dmp
memory/4560-68-0x000002B0EB780000-0x000002B0EB790000-memory.dmp
memory/4560-113-0x000002B0EB910000-0x000002B0EB920000-memory.dmp
memory/4560-73-0x000002B0EB870000-0x000002B0EB880000-memory.dmp
memory/4560-72-0x000002B0EB790000-0x000002B0EB7A0000-memory.dmp
memory/4560-76-0x000002B0EB880000-0x000002B0EB890000-memory.dmp
memory/4560-75-0x000002B0EB7A0000-0x000002B0EB7B0000-memory.dmp
memory/4560-78-0x000002B0EB7B0000-0x000002B0EB7C0000-memory.dmp
memory/4560-79-0x000002B0EB890000-0x000002B0EB8A0000-memory.dmp
memory/4560-82-0x000002B0EB8A0000-0x000002B0EB8B0000-memory.dmp
memory/4560-81-0x000002B0EB7C0000-0x000002B0EB7D0000-memory.dmp
memory/4560-91-0x000002B0EB8D0000-0x000002B0EB8E0000-memory.dmp
memory/4560-90-0x000002B0EB8C0000-0x000002B0EB8D0000-memory.dmp
memory/4560-89-0x000002B0EB8B0000-0x000002B0EB8C0000-memory.dmp
memory/4560-88-0x000002B0EB7E0000-0x000002B0EB7F0000-memory.dmp
memory/4560-87-0x000002B0EB7D0000-0x000002B0EB7E0000-memory.dmp
memory/4560-86-0x000002B0E9BB0000-0x000002B0E9BB1000-memory.dmp
memory/4560-109-0x000002B0EB900000-0x000002B0EB910000-memory.dmp
memory/4560-104-0x000002B0EB8E0000-0x000002B0EB8F0000-memory.dmp
memory/4560-103-0x000002B0EB840000-0x000002B0EB850000-memory.dmp
memory/4560-102-0x000002B0EB830000-0x000002B0EB840000-memory.dmp
memory/4560-101-0x000002B0EB820000-0x000002B0EB830000-memory.dmp
memory/4560-23-0x000002B0EB770000-0x000002B0EB780000-memory.dmp
memory/4560-99-0x000002B0EB800000-0x000002B0EB810000-memory.dmp
memory/4560-98-0x000002B0EB7F0000-0x000002B0EB800000-memory.dmp
memory/4560-106-0x000002B0EB8F0000-0x000002B0EB900000-memory.dmp
memory/4560-108-0x000002B0EB850000-0x000002B0EB860000-memory.dmp
memory/4560-97-0x000002B0E9BB0000-0x000002B0E9BB1000-memory.dmp
memory/4560-21-0x000002B0EB760000-0x000002B0EB770000-memory.dmp
memory/4560-69-0x000002B0EB860000-0x000002B0EB870000-memory.dmp
memory/4560-112-0x000002B0EB860000-0x000002B0EB870000-memory.dmp
memory/4560-116-0x000002B0EB920000-0x000002B0EB930000-memory.dmp
memory/4560-115-0x000002B0EB870000-0x000002B0EB880000-memory.dmp
memory/4560-118-0x000002B0EB880000-0x000002B0EB890000-memory.dmp
memory/4560-119-0x000002B0EB930000-0x000002B0EB940000-memory.dmp
memory/4560-123-0x000002B0EB940000-0x000002B0EB950000-memory.dmp
memory/4560-122-0x000002B0EB890000-0x000002B0EB8A0000-memory.dmp
memory/4560-125-0x000002B0EB8A0000-0x000002B0EB8B0000-memory.dmp
memory/4560-126-0x000002B0EB950000-0x000002B0EB960000-memory.dmp
memory/4560-129-0x000002B0E9BB0000-0x000002B0E9BB1000-memory.dmp
memory/4560-132-0x000002B0EB8B0000-0x000002B0EB8C0000-memory.dmp
memory/4560-133-0x000002B0EB8C0000-0x000002B0EB8D0000-memory.dmp
memory/4560-135-0x000002B0EB960000-0x000002B0EB970000-memory.dmp
memory/4560-134-0x000002B0EB8D0000-0x000002B0EB8E0000-memory.dmp
memory/4560-137-0x000002B0EB970000-0x000002B0EB980000-memory.dmp
memory/4560-143-0x000002B0EB8E0000-0x000002B0EB8F0000-memory.dmp
memory/4560-144-0x000002B0EB980000-0x000002B0EB990000-memory.dmp
memory/4560-145-0x000002B0E9BB0000-0x000002B0E9BB1000-memory.dmp
memory/4560-149-0x000002B0EB8F0000-0x000002B0EB900000-memory.dmp
memory/4560-150-0x000002B0EB900000-0x000002B0EB910000-memory.dmp
memory/4560-153-0x000002B0E9BB0000-0x000002B0E9BB1000-memory.dmp
memory/4560-160-0x000002B0EB770000-0x000002B0EB780000-memory.dmp
memory/4560-177-0x000002B0EB8C0000-0x000002B0EB8D0000-memory.dmp
memory/4560-176-0x000002B0EB8B0000-0x000002B0EB8C0000-memory.dmp
memory/4560-175-0x000002B0EB860000-0x000002B0EB870000-memory.dmp
memory/4560-174-0x000002B0EB850000-0x000002B0EB860000-memory.dmp
memory/4560-173-0x000002B0EB840000-0x000002B0EB850000-memory.dmp
memory/4560-172-0x000002B0EB830000-0x000002B0EB840000-memory.dmp
memory/4560-171-0x000002B0EB820000-0x000002B0EB830000-memory.dmp
memory/4560-170-0x000002B0EB810000-0x000002B0EB820000-memory.dmp
memory/4560-169-0x000002B0EB800000-0x000002B0EB810000-memory.dmp
memory/4560-168-0x000002B0EB7F0000-0x000002B0EB800000-memory.dmp
memory/4560-167-0x000002B0EB7E0000-0x000002B0EB7F0000-memory.dmp
memory/4560-166-0x000002B0EB7D0000-0x000002B0EB7E0000-memory.dmp
memory/4560-165-0x000002B0EB4B0000-0x000002B0EB720000-memory.dmp
memory/4560-164-0x000002B0EB7B0000-0x000002B0EB7C0000-memory.dmp
memory/4560-163-0x000002B0EB7A0000-0x000002B0EB7B0000-memory.dmp
memory/4560-162-0x000002B0EB790000-0x000002B0EB7A0000-memory.dmp
memory/4560-161-0x000002B0EB780000-0x000002B0EB790000-memory.dmp
memory/4560-159-0x000002B0EB760000-0x000002B0EB770000-memory.dmp
memory/4560-22-0x000002B0E9BB0000-0x000002B0E9BB1000-memory.dmp
memory/4560-18-0x000002B0EB750000-0x000002B0EB760000-memory.dmp
memory/4560-16-0x000002B0EB740000-0x000002B0EB750000-memory.dmp
memory/4560-14-0x000002B0EB730000-0x000002B0EB740000-memory.dmp
memory/4560-12-0x000002B0EB720000-0x000002B0EB730000-memory.dmp
memory/4560-2-0x000002B0EB4B0000-0x000002B0EB720000-memory.dmp
memory/4560-158-0x000002B0EB750000-0x000002B0EB760000-memory.dmp
memory/4560-157-0x000002B0EB740000-0x000002B0EB750000-memory.dmp
memory/4560-156-0x000002B0EB730000-0x000002B0EB740000-memory.dmp
memory/4560-155-0x000002B0EB720000-0x000002B0EB730000-memory.dmp
memory/4560-154-0x000002B0EB7C0000-0x000002B0EB7D0000-memory.dmp