Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
29/11/2024, 01:00
General
- Target 4c7d1c638f7d679e0356cf63774f39abef984a6073e0698b21769fbaef1c7162.jar
- Size 264KB
- Sample241129-bctx5sspdj
- SHA256 4c7d1c638f7d679e0356cf63774f39abef984a6073e0698b21769fbaef1c7162
Malware Config
Extracted
-
strrat
-
badmiles.ddns.net:5055
-
license_id
4OI0-V4TA-Z8G4-WQF1-B9VH
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Strrat family
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\4c7d1c638f7d679e0356cf63774f39abef984a6073e0698b21769fbaef1c7162.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\4c7d1c638f7d679e0356cf63774f39abef984a6073e0698b21769fbaef1c7162.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4c7d1c638f7d679e0356cf63774f39abef984a6073e0698b21769fbaef1c7162.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4c7d1c638f7d679e0356cf63774f39abef984a6073e0698b21769fbaef1c7162.jar"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\4c7d1c638f7d679e0356cf63774f39abef984a6073e0698b21769fbaef1c7162.jar"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
4c7d1c638f7d679e0356cf63774f39abef984a6073e0698b21769fbaef1c7162.jar
jna558588096542470883.dll
83aa4cc77f591dfc2374580bbd95f6ba_4304acb9-c3f6-452a-9860-eb4e85d38d4e
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1788-112-0x00000251DA200000-0x00000251DA210000-memory.dmp
memory/1788-130-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-20-0x00000251DA090000-0x00000251DA0A0000-memory.dmp
memory/1788-23-0x00000251DA0A0000-0x00000251DA0B0000-memory.dmp
memory/1788-24-0x00000251DA0B0000-0x00000251DA0C0000-memory.dmp
memory/1788-31-0x00000251DA0C0000-0x00000251DA0D0000-memory.dmp
memory/1788-32-0x00000251DA0D0000-0x00000251DA0E0000-memory.dmp
memory/1788-36-0x00000251D9DE0000-0x00000251DA050000-memory.dmp
memory/1788-41-0x00000251DA050000-0x00000251DA060000-memory.dmp
memory/1788-40-0x00000251DA0F0000-0x00000251DA100000-memory.dmp
memory/1788-39-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-38-0x00000251DA100000-0x00000251DA110000-memory.dmp
memory/1788-37-0x00000251DA0E0000-0x00000251DA0F0000-memory.dmp
memory/1788-45-0x00000251DA110000-0x00000251DA120000-memory.dmp
memory/1788-44-0x00000251DA060000-0x00000251DA070000-memory.dmp
memory/1788-47-0x00000251DA120000-0x00000251DA130000-memory.dmp
memory/1788-46-0x00000251DA070000-0x00000251DA080000-memory.dmp
memory/1788-50-0x00000251DA130000-0x00000251DA140000-memory.dmp
memory/1788-49-0x00000251DA080000-0x00000251DA090000-memory.dmp
memory/1788-55-0x00000251DA0A0000-0x00000251DA0B0000-memory.dmp
memory/1788-56-0x00000251DA150000-0x00000251DA160000-memory.dmp
memory/1788-53-0x00000251DA090000-0x00000251DA0A0000-memory.dmp
memory/1788-54-0x00000251DA140000-0x00000251DA150000-memory.dmp
memory/1788-59-0x00000251DA0B0000-0x00000251DA0C0000-memory.dmp
memory/1788-60-0x00000251DA160000-0x00000251DA170000-memory.dmp
memory/1788-63-0x00000251DA0C0000-0x00000251DA0D0000-memory.dmp
memory/1788-64-0x00000251DA170000-0x00000251DA180000-memory.dmp
memory/1788-65-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-66-0x00000251DA0D0000-0x00000251DA0E0000-memory.dmp
memory/1788-67-0x00000251DA0E0000-0x00000251DA0F0000-memory.dmp
memory/1788-68-0x00000251DA100000-0x00000251DA110000-memory.dmp
memory/1788-70-0x00000251DA0F0000-0x00000251DA100000-memory.dmp
memory/1788-71-0x00000251DA110000-0x00000251DA120000-memory.dmp
memory/1788-72-0x00000251DA120000-0x00000251DA130000-memory.dmp
memory/1788-73-0x00000251DA130000-0x00000251DA140000-memory.dmp
memory/1788-74-0x00000251DA140000-0x00000251DA150000-memory.dmp
memory/1788-75-0x00000251DA150000-0x00000251DA160000-memory.dmp
memory/1788-76-0x00000251DA160000-0x00000251DA170000-memory.dmp
memory/1788-77-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-80-0x00000251DA170000-0x00000251DA180000-memory.dmp
memory/1788-81-0x00000251DA180000-0x00000251DA190000-memory.dmp
memory/1788-88-0x00000251DA190000-0x00000251DA1A0000-memory.dmp
memory/1788-89-0x00000251DA1A0000-0x00000251DA1B0000-memory.dmp
memory/1788-91-0x00000251DA1B0000-0x00000251DA1C0000-memory.dmp
memory/1788-94-0x00000251DA1C0000-0x00000251DA1D0000-memory.dmp
memory/1788-95-0x00000251DA1D0000-0x00000251DA1E0000-memory.dmp
memory/1788-96-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-97-0x00000251DA180000-0x00000251DA190000-memory.dmp
memory/1788-98-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-101-0x00000251DA1E0000-0x00000251DA1F0000-memory.dmp
memory/1788-102-0x00000251DA190000-0x00000251DA1A0000-memory.dmp
memory/1788-103-0x00000251DA1F0000-0x00000251DA200000-memory.dmp
memory/1788-104-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-105-0x00000251DA1A0000-0x00000251DA1B0000-memory.dmp
memory/1788-106-0x00000251DA1B0000-0x00000251DA1C0000-memory.dmp
memory/1788-108-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-16-0x00000251DA070000-0x00000251DA080000-memory.dmp
memory/1788-120-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-114-0x00000251DA1D0000-0x00000251DA1E0000-memory.dmp
memory/1788-115-0x00000251DA210000-0x00000251DA220000-memory.dmp
memory/1788-18-0x00000251DA080000-0x00000251DA090000-memory.dmp
memory/1788-117-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-111-0x00000251DA1C0000-0x00000251DA1D0000-memory.dmp
memory/1788-121-0x00000251DA220000-0x00000251DA230000-memory.dmp
memory/1788-123-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-125-0x00000251DA230000-0x00000251DA240000-memory.dmp
memory/1788-128-0x00000251DA240000-0x00000251DA250000-memory.dmp
memory/1788-127-0x00000251DA1E0000-0x00000251DA1F0000-memory.dmp
memory/1788-129-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-119-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-133-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-140-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-142-0x00000251DA250000-0x00000251DA260000-memory.dmp
memory/1788-141-0x00000251DA1F0000-0x00000251DA200000-memory.dmp
memory/1788-144-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-147-0x00000251DA260000-0x00000251DA270000-memory.dmp
memory/1788-149-0x00000251DA200000-0x00000251DA210000-memory.dmp
memory/1788-150-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-151-0x00000251DA210000-0x00000251DA220000-memory.dmp
memory/1788-152-0x00000251DA220000-0x00000251DA230000-memory.dmp
memory/1788-153-0x00000251DA230000-0x00000251DA240000-memory.dmp
memory/1788-154-0x00000251DA240000-0x00000251DA250000-memory.dmp
memory/1788-155-0x00000251DA250000-0x00000251DA260000-memory.dmp
memory/1788-156-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-164-0x00000251DA260000-0x00000251DA270000-memory.dmp
memory/1788-167-0x00000251DA270000-0x00000251DA280000-memory.dmp
memory/1788-170-0x00000251DA280000-0x00000251DA290000-memory.dmp
memory/1788-173-0x00000251DA270000-0x00000251DA280000-memory.dmp
memory/1788-175-0x00000251DA280000-0x00000251DA290000-memory.dmp
memory/1788-180-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-181-0x00000251DA290000-0x00000251DA2A0000-memory.dmp
memory/1788-187-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-191-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-192-0x00000251DA2A0000-0x00000251DA2B0000-memory.dmp
memory/1788-194-0x00000251DA2B0000-0x00000251DA2C0000-memory.dmp
memory/1788-195-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-199-0x00000251DA290000-0x00000251DA2A0000-memory.dmp
memory/1788-201-0x00000251DA2A0000-0x00000251DA2B0000-memory.dmp
memory/1788-202-0x00000251DA2B0000-0x00000251DA2C0000-memory.dmp
memory/1788-211-0x00000251D9DC0000-0x00000251D9DC1000-memory.dmp
memory/1788-215-0x00000251DA060000-0x00000251DA070000-memory.dmp
memory/1788-220-0x00000251DA0B0000-0x00000251DA0C0000-memory.dmp
memory/1788-228-0x00000251DA130000-0x00000251DA140000-memory.dmp
memory/1788-227-0x00000251DA120000-0x00000251DA130000-memory.dmp
memory/1788-226-0x00000251DA110000-0x00000251DA120000-memory.dmp
memory/1788-225-0x00000251D9DE0000-0x00000251DA050000-memory.dmp
memory/1788-224-0x00000251DA100000-0x00000251DA110000-memory.dmp
memory/1788-223-0x00000251DA0E0000-0x00000251DA0F0000-memory.dmp
memory/1788-222-0x00000251DA0D0000-0x00000251DA0E0000-memory.dmp
memory/1788-221-0x00000251DA0C0000-0x00000251DA0D0000-memory.dmp
memory/1788-219-0x00000251DA0A0000-0x00000251DA0B0000-memory.dmp
memory/1788-14-0x00000251DA060000-0x00000251DA070000-memory.dmp
memory/1788-218-0x00000251DA090000-0x00000251DA0A0000-memory.dmp
memory/1788-217-0x00000251DA080000-0x00000251DA090000-memory.dmp
memory/1788-216-0x00000251DA070000-0x00000251DA080000-memory.dmp
memory/1788-214-0x00000251DA050000-0x00000251DA060000-memory.dmp
memory/1788-213-0x00000251DA0F0000-0x00000251DA100000-memory.dmp
memory/1788-2-0x00000251D9DE0000-0x00000251DA050000-memory.dmp
memory/1788-12-0x00000251DA050000-0x00000251DA060000-memory.dmp
memory/2256-329-0x000001215B7D0000-0x000001215B7D1000-memory.dmp
memory/3588-292-0x000002368DAD0000-0x000002368DAD1000-memory.dmp