Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 12:00
General
- Target CrossRAT.jar
- Size 217KB
- Sample260508-n6c8psbw4j
- SHA256 15af5bbf3c8d5e5db41fd7c3d722e8b247b40f2da747d5c334f7fd80b715a649
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\CrossRAT.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ /v mediamgrs /t REG_SZ /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar "C:\Users\Admin\AppData\Local\Temp\mediamgrs.jar"" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3008-2-0x00000226EB040000-0x00000226EB2B0000-memory.dmp
memory/3008-13-0x00000226E9840000-0x00000226E9841000-memory.dmp
memory/3008-18-0x00000226E9870000-0x00000226E987C000-memory.dmp
memory/3008-19-0x00000226EB040000-0x00000226EB2B0000-memory.dmp