Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
27/01/2025, 19:44
General
- Target apktool/apktool.jar
- Size 8.8MB
- Sample250127-yf4m3ssrev
- SHA256 e03f8e5d55e6e767daa3eacfe503a1437354b34027fc458820b6f8076398b967
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\apktool\apktool.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\zjpHFqNjrT4568742846910377017.tmp2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1738007093969.tmp3⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1738007093969.tmp" /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1738007093969.tmp" /f4⤵
- Adds Run key to start application
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
zjpHFqNjrT4568742846910377017.tmp
memory/528-58-0x000001BA19F60000-0x000001BA1A1D0000-memory.dmp
memory/528-61-0x000001BA1A1E0000-0x000001BA1A1F0000-memory.dmp
memory/528-89-0x000001BA1A290000-0x000001BA1A2A0000-memory.dmp
memory/528-23-0x000001BA19F60000-0x000001BA1A1D0000-memory.dmp
memory/528-87-0x000001BA1A280000-0x000001BA1A290000-memory.dmp
memory/528-37-0x000001BA1A1D0000-0x000001BA1A1E0000-memory.dmp
memory/528-39-0x000001BA1A1E0000-0x000001BA1A1F0000-memory.dmp
memory/528-41-0x000001BA1A1F0000-0x000001BA1A200000-memory.dmp
memory/528-62-0x000001BA1A250000-0x000001BA1A260000-memory.dmp
memory/528-45-0x000001BA1A210000-0x000001BA1A220000-memory.dmp
memory/528-48-0x000001BA1A220000-0x000001BA1A230000-memory.dmp
memory/528-51-0x000001BA1A230000-0x000001BA1A240000-memory.dmp
memory/528-54-0x000001BA1A240000-0x000001BA1A250000-memory.dmp
memory/528-56-0x000001BA19F40000-0x000001BA19F41000-memory.dmp
memory/528-86-0x000001BA1A280000-0x000001BA1A290000-memory.dmp
memory/528-84-0x000001BA1A270000-0x000001BA1A280000-memory.dmp
memory/528-44-0x000001BA1A200000-0x000001BA1A210000-memory.dmp
memory/528-59-0x000001BA1A1D0000-0x000001BA1A1E0000-memory.dmp
memory/528-63-0x000001BA1A1F0000-0x000001BA1A200000-memory.dmp
memory/528-65-0x000001BA1A200000-0x000001BA1A210000-memory.dmp
memory/528-66-0x000001BA1A210000-0x000001BA1A220000-memory.dmp
memory/528-68-0x000001BA1A220000-0x000001BA1A230000-memory.dmp
memory/528-69-0x000001BA1A230000-0x000001BA1A240000-memory.dmp
memory/528-71-0x000001BA1A240000-0x000001BA1A250000-memory.dmp
memory/528-72-0x000001BA1A250000-0x000001BA1A260000-memory.dmp
memory/528-79-0x000001BA1A260000-0x000001BA1A270000-memory.dmp
memory/528-80-0x000001BA1A260000-0x000001BA1A270000-memory.dmp
memory/528-83-0x000001BA1A270000-0x000001BA1A280000-memory.dmp
memory/2392-2-0x000002D54F970000-0x000002D54FBE0000-memory.dmp
memory/2392-19-0x000002D54F970000-0x000002D54FBE0000-memory.dmp
memory/2392-16-0x000002D54F950000-0x000002D54F951000-memory.dmp
memory/2392-18-0x000002D54F950000-0x000002D54F951000-memory.dmp