| File name: | 82716eae75bfbfa4727319e6b8a19984e71b0f8f53033608785af8f53b30174f.jar |
| Full analysis: | https://app.any.run/tasks/5a3b4d13-a8b1-4b87-bae3-d17318c505c0 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | September 19, 2023, 20:20:04 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 3B05FF4BC31CB581F194DC418F334D8E |
| SHA1: | D178F42532A217773A5C69B2B2650085F4BC10F8 |
| SHA256: | 82716EAE75BFBFA4727319E6B8A19984E71B0F8F53033608785AF8F53B30174F |
| SSDEEP: | 6144:rCzTWxd8WTN4V8F0dE78NX3rJrLGs3ggwwfM7YKfgn:rz8oE6cXlrLPgzwfM8K4 |
MALICIOUS
StrRat is detected
- javaw.exe (PID: 1872)
Create files in the Startup directory
- java.exe (PID: 1992)
Uses Task Scheduler to run other applications
- cmd.exe (PID: 2668)
Loads dropped or rewritten executable
- java.exe (PID: 2056)
UAC/LUA settings modification
- se.exe (PID: 2032)
Application was dropped or rewritten from another process
- se.exe (PID: 2784)
- se.exe (PID: 2428)
- se.exe (PID: 2032)
Connects to the CnC server
- java.exe (PID: 2056)
STRRAT was detected
- java.exe (PID: 2056)
STRRAT detected by memory dumps
- java.exe (PID: 2056)
SUSPICIOUS
Reads settings of System Certificates
- filezilla.exe (PID: 2916)
Starts CMD.EXE for commands execution
- java.exe (PID: 1992)
- java.exe (PID: 2056)
Application launched itself
- java.exe (PID: 1992)
Uses WMIC.EXE to obtain volume information
- cmd.exe (PID: 2748)
Reads the Internet Settings
- WMIC.exe (PID: 2896)
- cmd.exe (PID: 2340)
- WMIC.exe (PID: 3748)
- WMIC.exe (PID: 2940)
- WMIC.exe (PID: 2404)
Uses WMIC.EXE to obtain operating system information
- cmd.exe (PID: 2876)
- cmd.exe (PID: 1236)
Connects to unusual port
- java.exe (PID: 2056)
- iexplore.exe (PID: 3692)
Uses WMIC.EXE to obtain Windows Installer data
- cmd.exe (PID: 3892)
Process requests binary or script from the Internet
- java.exe (PID: 2056)
Connects to the server without a host name
- java.exe (PID: 2056)
INFO
Creates files in the program directory
- javaw.exe (PID: 1872)
Checks supported languages
- javaw.exe (PID: 1872)
- filezilla.exe (PID: 2916)
- java.exe (PID: 1992)
- java.exe (PID: 2056)
- se.exe (PID: 2032)
- iexplore.exe (PID: 3692)
Reads the computer name
- javaw.exe (PID: 1872)
- filezilla.exe (PID: 2916)
- java.exe (PID: 1992)
- java.exe (PID: 2056)
- iexplore.exe (PID: 3692)
Create files in a temporary directory
- javaw.exe (PID: 1872)
- java.exe (PID: 1992)
- java.exe (PID: 2056)
- se.exe (PID: 2032)
- iexplore.exe (PID: 3692)
Reads the machine GUID from the registry
- javaw.exe (PID: 1872)
- filezilla.exe (PID: 2916)
- java.exe (PID: 2056)
- se.exe (PID: 2032)
Manual execution by a user
- filezilla.exe (PID: 2916)
Creates files or folders in the user directory
- filezilla.exe (PID: 2916)
- java.exe (PID: 1992)
- java.exe (PID: 2056)
- iexplore.exe (PID: 3692)
The executable file from the user directory is run by the CMD process
- se.exe (PID: 2428)
- se.exe (PID: 2032)
- se.exe (PID: 2784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
STRRAT
(PID) Process(2056) java.exe
C2bmh-global.myfirewall.org
Port1414
URLhttp://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Options
Startup Folder Persistencetrue
Secondary Startup Folder Persistencetrue
Skype Scheduled Task Persistencetrue
Proxybmh-global.myfirewall.org
LIDNMW9-U4JI-9LTC-U9WX-QZ
TRiD
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
EXIF
ZIP
| ZipFileName: | META-INF/MANIFEST.MF |
|---|---|
| ZipUncompressedSize: | - |
| ZipCompressedSize: | - |
| ZipCRC: | 0x00000000 |
| ZipModifyDate: | 2023:09:13 00:42:42 |
| ZipCompression: | Deflated |
| ZipBitFlag: | 0x0808 |
| ZipRequiredVersion: | 20 |
Total processes
66
Monitored processes
20
Malicious processes
3
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 600 | C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M | C:\Windows\System32\icacls.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1236 | cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list" | C:\Windows\System32\cmd.exe | — | java.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1872 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\82716eae75bfbfa4727319e6b8a19984e71b0f8f53033608785af8f53b30174f.jar" | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | explorer.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 1992 | "C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar "C:\Users\admin\82716eae75bfbfa4727319e6b8a19984e71b0f8f53033608785af8f53b30174f.jar" | C:\Program Files\Java\jre1.8.0_271\bin\java.exe | javaw.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 2032 | "C:\Users\admin\AppData\Roaming\se.exe" | C:\Users\admin\AppData\Roaming\se.exe | cmd.exe | ||||||||||||
User: admin Company: Abronsius Integrity Level: HIGH Description: Update Exit code: 0 Version: 3.00.0010 Modules
| |||||||||||||||
| 2056 | "C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar "C:\Users\admin\AppData\Roaming\82716eae75bfbfa4727319e6b8a19984e71b0f8f53033608785af8f53b30174f.jar" | C:\Program Files\Java\jre1.8.0_271\bin\java.exe | java.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
STRRAT(PID) Process(2056) java.exe C2bmh-global.myfirewall.org Port1414 URLhttp://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5 Options Startup Folder Persistencetrue Secondary Startup Folder Persistencetrue Skype Scheduled Task Persistencetrue Proxybmh-global.myfirewall.org LIDNMW9-U4JI-9LTC-U9WX-QZ | |||||||||||||||
| 2340 | cmd.exe /c "C:\Users\admin\AppData\Roaming\se.exe" | C:\Windows\System32\cmd.exe | — | java.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2404 | wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2428 | "C:\Users\admin\AppData\Roaming\se.exe" | C:\Users\admin\AppData\Roaming\se.exe | — | cmd.exe | |||||||||||
User: admin Company: Abronsius Integrity Level: MEDIUM Description: Update Exit code: 3221226540 Version: 3.00.0010 Modules
| |||||||||||||||
| 2668 | cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\82716eae75bfbfa4727319e6b8a19984e71b0f8f53033608785af8f53b30174f.jar" | C:\Windows\System32\cmd.exe | — | java.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
4 799
Read events
4 790
Write events
9
Delete events
0
Modification events
| (PID) Process: | (2340) cmd.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2340) cmd.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2340) cmd.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2340) cmd.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2032) se.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
| Operation: | write | Name: | EnableLUA |
Value: 1 | |||
Executable files
9
Suspicious files
10
Text files
31
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1872 | javaw.exe | C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamp | text | |
MD5:8B74298E949FA62B73B97DB6A497938D | SHA256:51D30EDDFD35CCD041E2921BEBAF29B1BB5D22F9E9C2069DD1F607FA6DABB62F | |||
| 1872 | javaw.exe | C:\Users\admin\lib\jna-platform-5.5.0.jard | java | |
MD5:2F4A99C2758E72EE2B59A73586A2322F | SHA256:24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5 | |||
| 1872 | javaw.exe | C:\Users\admin\lib\system-hook-3.5.jard | compressed | |
MD5:E1AA38A1E78A76A6DE73EFAE136CDB3A | SHA256:2DDDA8AF6FAEF8BDE46ACF43EC546603180BCF8DCB2E5591FFF8AC9CD30B5609 | |||
| 1872 | javaw.exe | C:\Users\admin\lib\jna-platform-5.5.0.jar | java | |
MD5:2F4A99C2758E72EE2B59A73586A2322F | SHA256:24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5 | |||
| 1872 | javaw.exe | C:\Users\admin\lib\system-hook-3.5.jar | compressed | |
MD5:E1AA38A1E78A76A6DE73EFAE136CDB3A | SHA256:2DDDA8AF6FAEF8BDE46ACF43EC546603180BCF8DCB2E5591FFF8AC9CD30B5609 | |||
| 1872 | javaw.exe | C:\Users\admin\lib\jna-5.5.0.jar | java | |
MD5:ACFB5B5FD9EE10BF69497792FD469F85 | SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E | |||
| 1872 | javaw.exe | C:\Users\admin\lib\jna-5.5.0.jard | java | |
MD5:ACFB5B5FD9EE10BF69497792FD469F85 | SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E | |||
| 2916 | filezilla.exe | C:\Users\admin\AppData\Local\FileZilla\default_processqueue20x20.png | image | |
MD5:8981536CE9B6CA800D4AA3E1531F5E18 | SHA256:FDF9033E11E9A2573320A4012154D4014AD288C3F6528079F22379566BE75D55 | |||
| 2916 | filezilla.exe | C:\Users\admin\AppData\Local\FileZilla\default_remotetreeview20x20.png | image | |
MD5:6C92B93B3D359862261CA013F82A67B9 | SHA256:C9FB39828A6523088FACF944E2DA8BB2844D902C23BF37CBD9A855B316E507D6 | |||
| 2916 | filezilla.exe | C:\Users\admin\AppData\Roaming\FileZilla\layout.xml | xml | |
MD5:2C67357412FE5428D2EB67E2178925FA | SHA256:6E8BEE236C7BB6E2CD249AF7449B0F08AFCEBEBE4140CF818750E4489D570B69 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
18
DNS requests
14
Threats
23
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2056 | java.exe | GET | 200 | 95.214.27.111:80 | http://95.214.27.111/se.exe | unknown | executable | 172 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3284 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1872 | javaw.exe | 140.82.121.4:443 | github.com | GITHUB | US | unknown |
1872 | javaw.exe | 199.232.196.209:443 | repo1.maven.org | FASTLY | US | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1872 | javaw.exe | 185.199.108.133:443 | objects.githubusercontent.com | FASTLY | US | unknown |
2056 | java.exe | 95.214.27.111:1414 | bmh-global.myfirewall.org | — | US | malicious |
2056 | java.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | unknown |
2056 | java.exe | 95.214.27.111:80 | bmh-global.myfirewall.org | — | US | malicious |
3692 | iexplore.exe | 95.214.27.111:5344 | bmh-global.myfirewall.org | — | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
github.com |
| shared |
repo1.maven.org |
| whitelisted |
dns.msftncsi.com |
| shared |
objects.githubusercontent.com |
| shared |
bmh-global.myfirewall.org |
| malicious |
ip-api.com |
| shared |
sandshoe.myfirewall.org |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1088 | svchost.exe | Potentially Bad Traffic | ET INFO Observed DNS Query to DDNS Domain .myfirewall .org |
2056 | java.exe | Malware Command and Control Activity Detected | ET MALWARE STRRAT CnC Checkin |
2056 | java.exe | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.8.x Detected |
2056 | java.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
2056 | java.exe | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |
2056 | java.exe | Misc activity | ET HUNTING Suspicious EXE requested with Java UA |
2056 | java.exe | A Network Trojan was detected | ET MALWARE Java EXE Download by Vulnerable Version - Likely Driveby |
2056 | java.exe | Misc activity | ET POLICY Java EXE Download |
2056 | java.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2056 | java.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |