Analysis
- max time kernel
150s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
01/04/2026, 02:48
General
- Target REQUEST FOR QUOTATION.js
- Size 185KB
- Sample260401-day57abt2x
- SHA256 a05e19a327fb6c9208abf7866ef09c5efffabc04a80456b49c81c790a40880c5
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Strrat family
- Drops startup file 1 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\nlzglmxzm.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\nlzglmxzm.txt"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\nlzglmxzm.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\nlzglmxzm.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\nlzglmxzm.txt"4⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\nlzglmxzm.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna4681519566353248814.dll
83aa4cc77f591dfc2374580bbd95f6ba_b06d8a60-c1ae-4b77-980b-23dce8539cb9
nlzglmxzm.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1056-2-0x00007FF9E6A40000-0x00007FF9E73E1000-memory.dmp
memory/1056-6-0x000001D73C640000-0x000001D73C6EE000-memory.dmp
memory/1056-7-0x000001D73DED0000-0x000001D73DEDC000-memory.dmp
memory/1056-8-0x00007FF9E6A40000-0x00007FF9E73E1000-memory.dmp
memory/1056-3-0x00007FF9E6A40000-0x00007FF9E73E1000-memory.dmp
memory/1056-0-0x00007FF9E6CF5000-0x00007FF9E6CF6000-memory.dmp
memory/2196-103-0x00000126391B0000-0x00000126391C0000-memory.dmp
memory/2196-119-0x0000012639200000-0x0000012639210000-memory.dmp
memory/2196-29-0x00000126390E0000-0x00000126390F0000-memory.dmp
memory/2196-32-0x0000012639100000-0x0000012639110000-memory.dmp
memory/2196-35-0x0000012639110000-0x0000012639120000-memory.dmp
memory/2196-45-0x0000012639130000-0x0000012639140000-memory.dmp
memory/2196-44-0x0000012639140000-0x0000012639150000-memory.dmp
memory/2196-43-0x0000012639120000-0x0000012639130000-memory.dmp
memory/2196-42-0x0000012638E40000-0x00000126390B0000-memory.dmp
memory/2196-50-0x0000012639160000-0x0000012639170000-memory.dmp
memory/2196-49-0x0000012639150000-0x0000012639160000-memory.dmp
memory/2196-53-0x0000012639170000-0x0000012639180000-memory.dmp
memory/2196-52-0x00000126390C0000-0x00000126390D0000-memory.dmp
memory/2196-51-0x00000126390B0000-0x00000126390C0000-memory.dmp
memory/2196-56-0x0000012639180000-0x0000012639190000-memory.dmp
memory/2196-55-0x00000126390D0000-0x00000126390E0000-memory.dmp
memory/2196-60-0x0000012639190000-0x00000126391A0000-memory.dmp
memory/2196-59-0x00000126390E0000-0x00000126390F0000-memory.dmp
memory/2196-63-0x00000126391A0000-0x00000126391B0000-memory.dmp
memory/2196-65-0x00000126391B0000-0x00000126391C0000-memory.dmp
memory/2196-64-0x0000012639100000-0x0000012639110000-memory.dmp
memory/2196-62-0x00000126390F0000-0x0000012639100000-memory.dmp
memory/2196-69-0x00000126391C0000-0x00000126391D0000-memory.dmp
memory/2196-68-0x0000012639110000-0x0000012639120000-memory.dmp
memory/2196-72-0x0000012638E20000-0x0000012638E21000-memory.dmp
memory/2196-74-0x0000012639140000-0x0000012639150000-memory.dmp
memory/2196-75-0x00000126391D0000-0x00000126391E0000-memory.dmp
memory/2196-73-0x0000012639120000-0x0000012639130000-memory.dmp
memory/2196-76-0x0000012638E20000-0x0000012638E21000-memory.dmp
memory/2196-80-0x00000126391E0000-0x00000126391F0000-memory.dmp
memory/2196-79-0x0000012639130000-0x0000012639140000-memory.dmp
memory/2196-87-0x0000012639200000-0x0000012639210000-memory.dmp
memory/2196-86-0x00000126391F0000-0x0000012639200000-memory.dmp
memory/2196-84-0x0000012639160000-0x0000012639170000-memory.dmp
memory/2196-89-0x0000012639210000-0x0000012639220000-memory.dmp
memory/2196-88-0x0000012639170000-0x0000012639180000-memory.dmp
memory/2196-98-0x0000012639190000-0x00000126391A0000-memory.dmp
memory/2196-101-0x0000012639250000-0x0000012639260000-memory.dmp
memory/2196-100-0x00000126391A0000-0x00000126391B0000-memory.dmp
memory/2196-97-0x0000012639240000-0x0000012639250000-memory.dmp
memory/2196-96-0x0000012639230000-0x0000012639240000-memory.dmp
memory/2196-95-0x0000012639220000-0x0000012639230000-memory.dmp
memory/2196-94-0x0000012639180000-0x0000012639190000-memory.dmp
memory/2196-83-0x0000012639150000-0x0000012639160000-memory.dmp
memory/2196-104-0x0000012639260000-0x0000012639270000-memory.dmp
memory/2196-26-0x00000126390D0000-0x00000126390E0000-memory.dmp
memory/2196-109-0x00000126391C0000-0x00000126391D0000-memory.dmp
memory/2196-110-0x0000012639270000-0x0000012639280000-memory.dmp
memory/2196-111-0x0000012638E20000-0x0000012638E21000-memory.dmp
memory/2196-113-0x00000126391D0000-0x00000126391E0000-memory.dmp
memory/2196-114-0x0000012639280000-0x0000012639290000-memory.dmp
memory/2196-117-0x0000012639290000-0x00000126392A0000-memory.dmp
memory/2196-116-0x00000126391E0000-0x00000126391F0000-memory.dmp
memory/2196-30-0x00000126390F0000-0x0000012639100000-memory.dmp
memory/2196-120-0x00000126392A0000-0x00000126392B0000-memory.dmp
memory/2196-122-0x00000126392B0000-0x00000126392C0000-memory.dmp
memory/2196-129-0x0000012639230000-0x0000012639240000-memory.dmp
memory/2196-134-0x00000126392E0000-0x00000126392F0000-memory.dmp
memory/2196-133-0x0000012639240000-0x0000012639250000-memory.dmp
memory/2196-132-0x0000012638E20000-0x0000012638E21000-memory.dmp
memory/2196-128-0x0000012639220000-0x0000012639230000-memory.dmp
memory/2196-127-0x00000126392D0000-0x00000126392E0000-memory.dmp
memory/2196-126-0x00000126392C0000-0x00000126392D0000-memory.dmp
memory/2196-125-0x0000012639210000-0x0000012639220000-memory.dmp
memory/2196-139-0x0000012639250000-0x0000012639260000-memory.dmp
memory/2196-140-0x00000126392F0000-0x0000012639300000-memory.dmp
memory/2196-146-0x0000012639260000-0x0000012639270000-memory.dmp
memory/2196-147-0x0000012639300000-0x0000012639310000-memory.dmp
memory/2196-150-0x0000012638E20000-0x0000012638E21000-memory.dmp
memory/2196-151-0x0000012639270000-0x0000012639280000-memory.dmp
memory/2196-153-0x0000012639280000-0x0000012639290000-memory.dmp
memory/2196-154-0x0000012639290000-0x00000126392A0000-memory.dmp
memory/2196-157-0x0000012638E20000-0x0000012638E21000-memory.dmp
memory/2196-161-0x00000126390C0000-0x00000126390D0000-memory.dmp
memory/2196-163-0x00000126390E0000-0x00000126390F0000-memory.dmp
memory/2196-177-0x00000126391D0000-0x00000126391E0000-memory.dmp
memory/2196-180-0x0000012639210000-0x0000012639220000-memory.dmp
memory/2196-179-0x0000012639200000-0x0000012639210000-memory.dmp
memory/2196-178-0x00000126391E0000-0x00000126391F0000-memory.dmp
memory/2196-176-0x00000126391C0000-0x00000126391D0000-memory.dmp
memory/2196-175-0x00000126391B0000-0x00000126391C0000-memory.dmp
memory/2196-174-0x00000126391A0000-0x00000126391B0000-memory.dmp
memory/2196-173-0x0000012639190000-0x00000126391A0000-memory.dmp
memory/2196-172-0x0000012639170000-0x0000012639180000-memory.dmp
memory/2196-171-0x0000012639160000-0x0000012639170000-memory.dmp
memory/2196-170-0x0000012639150000-0x0000012639160000-memory.dmp
memory/2196-168-0x0000012639140000-0x0000012639150000-memory.dmp
memory/2196-167-0x0000012639120000-0x0000012639130000-memory.dmp
memory/2196-166-0x0000012639110000-0x0000012639120000-memory.dmp
memory/2196-165-0x0000012639100000-0x0000012639110000-memory.dmp
memory/2196-164-0x0000012639130000-0x0000012639140000-memory.dmp
memory/2196-162-0x00000126390D0000-0x00000126390E0000-memory.dmp
memory/2196-24-0x00000126390C0000-0x00000126390D0000-memory.dmp
memory/2196-22-0x00000126390B0000-0x00000126390C0000-memory.dmp
memory/2196-169-0x0000012638E40000-0x00000126390B0000-memory.dmp
memory/2196-160-0x00000126390B0000-0x00000126390C0000-memory.dmp
memory/2196-159-0x00000126390F0000-0x0000012639100000-memory.dmp
memory/2196-158-0x0000012653AB0000-0x0000012653ABC000-memory.dmp
memory/2196-16-0x0000012638E40000-0x00000126390B0000-memory.dmp
memory/2196-20-0x0000012638E20000-0x0000012638E21000-memory.dmp
memory/3148-275-0x000001FCCA300000-0x000001FCCA301000-memory.dmp
memory/3148-280-0x000001FCE4F90000-0x000001FCE4F9C000-memory.dmp
memory/3372-281-0x0000020584B50000-0x0000020584BFE000-memory.dmp
memory/4592-241-0x000001D8BEC80000-0x000001D8BEC8C000-memory.dmp
memory/4592-240-0x000001D8BEC50000-0x000001D8BEC51000-memory.dmp
memory/4592-224-0x000001D8BEC50000-0x000001D8BEC51000-memory.dmp