Windows Analysis Report
EQUIPTMENT_ORDER.jar

Overview

General Information

Sample name: EQUIPTMENT_ORDER.jar
Analysis ID: 1430750
MD5: b42ff7e68ccb74b444fd8d30636466cf
SHA1: 854601f3529fed533b297b4904c67938152563b1
SHA256: eb8ff032ecdacae049aa7edcb3c76e2b3274e7b01dd19aacbd71cfb96f8c9529
Tags: jar
Infos:

Detection

STRRAT
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected STRRAT
Exploit detected, runtime environment starts unknown processes
Yara detected AllatoriJARObfuscator
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5 URL Reputation: Label: malware
Source: http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5 URL Reputation: Label: malware
Found malware configuration
Source: EQUIPTMENT_ORDER.jar Malware Configuration Extractor: STRRAT {"C2 list": "chongmei33.publicvm.com:44662", "url": "http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5", "Proxy": "chongmei33.publicvm.com:44662", "lid": "khonsari", "Startup": "true", "Secondary Startup": "true", "Scheduled Task": "true"}
Multi AV Scanner detection for submitted file
Source: EQUIPTMENT_ORDER.jar ReversingLabs: Detection: 44%
Source: EQUIPTMENT_ORDER.jar Virustotal: Detection: 50% Perma Link

Software Vulnerabilities
barindex
Exploit detected, runtime environment starts unknown processes
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\System32\conhost.exe
Source: java.exe, 00000003.00000002.3259064720.0000000009F92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000003.00000002.3259064720.000000000A000000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: java.exe, 00000003.00000002.3260493512.0000000015480000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: java.exe, 00000003.00000002.3259064720.000000000A000000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: java.exe, 00000003.00000002.3259064720.0000000009F67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: java.exe, 00000003.00000002.3259064720.000000000A000000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: java.exe, 00000003.00000002.3259064720.000000000A00E000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: java.exe, 00000003.00000002.3260493512.0000000015480000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: java.exe, 00000003.00000002.3259064720.000000000A007000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: java.exe, 00000003.00000002.3259064720.0000000009F67000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: java.exe, 00000003.00000002.3259064720.000000000A00E000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: java.exe, 00000003.00000002.3260493512.0000000015480000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Source: java.exe, 00000003.00000002.3259064720.000000000A108000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3260493512.0000000015480000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000003.00000002.3258479899.0000000004E4D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://null.oracle.com/k
Source: java.exe, 00000003.00000002.3259064720.000000000A000000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com
Source: java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: java.exe, 00000003.00000002.3260493512.0000000015480000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: java.exe, 00000003.00000002.3259064720.0000000009F67000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: java.exe, 00000003.00000002.3259064720.0000000009F92000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3259064720.0000000009F61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.allatori.com
Source: java.exe, 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3258479899.0000000004ECC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jar
Source: java.exe, 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jarc
Source: java.exe, 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3258479899.0000000004ECC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna-platform/5.5.0/jna-platform-5.5.0.jar
Source: java.exe, 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3258479899.0000000004ECC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jar
Source: java.exe, 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jark
Source: java.exe, 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.3258479899.0000000004ECC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jar

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000003.00000002.3259064720.0000000009F92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects files packed with Allatori Java Obfuscator Author: ditekSHen
Source: 00000003.00000002.3259064720.0000000009F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects files packed with Allatori Java Obfuscator Author: ditekSHen
Source: Process Memory Space: java.exe PID: 5552, type: MEMORYSTR Matched rule: Detects files packed with Allatori Java Obfuscator Author: ditekSHen
Yara signature match
Source: 00000003.00000002.3259064720.0000000009F92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_JAVA_Packed_Allatori author = ditekSHen, description = Detects files packed with Allatori Java Obfuscator
Source: 00000003.00000002.3259064720.0000000009F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_JAVA_Packed_Allatori author = ditekSHen, description = Detects files packed with Allatori Java Obfuscator
Source: Process Memory Space: java.exe PID: 5552, type: MEMORYSTR Matched rule: INDICATOR_JAVA_Packed_Allatori author = ditekSHen, description = Detects files packed with Allatori Java Obfuscator
Source: classification engine Classification label: mal88.troj.expl.evad.winJAR@7/52@0/0
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4444:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user Jump to behavior
Source: C:\Windows\System32\7za.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: EQUIPTMENT_ORDER.jar ReversingLabs: Detection: 44%
Source: EQUIPTMENT_ORDER.jar Virustotal: Detection: 50%
Source: unknown Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\EQUIPTMENT_ORDER.jar"
Source: C:\Windows\System32\7za.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Desktop\EQUIPTMENT_ORDER.jar" carLambo.FirstRun
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Source: C:\Windows\System32\7za.exe Section loaded: 7z.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: opengl32.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: glu32.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: ntmarta.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected

Data Obfuscation
barindex
Yara detected AllatoriJARObfuscator
Source: Yara match File source: 00000003.00000002.3259064720.0000000009F92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3259064720.0000000009F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: java.exe PID: 5552, type: MEMORYSTR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_028DA20A push ecx; ret 3_2_028DA21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_028DA21B push ecx; ret 3_2_028DA225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_028DB3B7 push 00000000h; mov dword ptr [esp], esp 3_2_028DB3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_028DBB67 push 00000000h; mov dword ptr [esp], esp 3_2_028DBB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_028DB947 push 00000000h; mov dword ptr [esp], esp 3_2_028DB96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_028DC477 push 00000000h; mov dword ptr [esp], esp 3_2_028DC49D
Uses cacls to modify the permissions of files
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: java.exe, 00000003.00000003.2001369183.0000000014E63000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000003.00000003.2001369183.0000000014E63000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000003.00000002.3258018628.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllMDs
Source: java.exe, 00000003.00000002.3258018628.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: java.exe, 00000003.00000003.2001369183.0000000014E63000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000003.00000002.3258018628.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 00000003.00000003.2001369183.0000000014E63000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: java/lang/VirtualMachineError.classPK
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Memory protected: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_028D03C0 cpuid 3_2_028D03C0
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\5552 VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected STRRAT
Source: Yara match File source: 00000003.00000002.3259064720.0000000009F67000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: java.exe PID: 5552, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected STRRAT
Source: Yara match File source: 00000003.00000002.3259064720.0000000009F67000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3258479899.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: java.exe PID: 5552, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430750 Sample: EQUIPTMENT_ORDER.jar Startdate: 24/04/2024 Architecture: WINDOWS Score: 88 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus detection for URL or domain 2->23 25 4 other signatures 2->25 7 java.exe 9 2->7         started        9 7za.exe 83 2->9         started        process3 process4 11 icacls.exe 1 7->11         started        13 conhost.exe 7->13         started        15 conhost.exe 9->15         started        process5 17 conhost.exe 11->17         started       
⊘No contacted IP infos