Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/04/2026, 13:30
General
- Target a05e19a327fb6c9208abf7866ef09c5efffabc04a80456b49c81c790a40880c5_zipper.js
- Size 186KB
- Sample260411-qrxpxab191
- SHA256 f26d0c5b188e5c42ea71d700d1f38fc1c0997944e614d535dba4d31133603a9f
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Strrat family
- Drops startup file 1 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\a05e19a327fb6c9208abf7866ef09c5efffabc04a80456b49c81c790a40880c5_zipper.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bhecphlitj.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\bhecphlitj.txt"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\bhecphlitj.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\bhecphlitj.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\bhecphlitj.txt"4⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\bhecphlitj.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna457383107484860235.dll
83aa4cc77f591dfc2374580bbd95f6ba_d693673f-8bca-4c68-bb37-3cd8b4157aa8
bhecphlitj.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1184-290-0x000001E8D4070000-0x000001E8D40A1000-memory.dmp
memory/2236-122-0x000001AF20B40000-0x000001AF20B50000-memory.dmp
memory/2236-183-0x000001AF20A90000-0x000001AF20AA0000-memory.dmp
memory/2236-35-0x000001AF209A0000-0x000001AF209B0000-memory.dmp
memory/2236-34-0x000001AF20990000-0x000001AF209A0000-memory.dmp
memory/2236-46-0x000001AF209D0000-0x000001AF209E0000-memory.dmp
memory/2236-45-0x000001AF209C0000-0x000001AF209D0000-memory.dmp
memory/2236-49-0x000001AF209E0000-0x000001AF209F0000-memory.dmp
memory/2236-48-0x000001AF20940000-0x000001AF20950000-memory.dmp
memory/2236-44-0x000001AF206D0000-0x000001AF20940000-memory.dmp
memory/2236-52-0x000001AF209F0000-0x000001AF20A00000-memory.dmp
memory/2236-51-0x000001AF20950000-0x000001AF20960000-memory.dmp
memory/2236-54-0x000001AF20970000-0x000001AF20980000-memory.dmp
memory/2236-53-0x000001AF20960000-0x000001AF20970000-memory.dmp
memory/2236-55-0x000001AF20A00000-0x000001AF20A10000-memory.dmp
memory/2236-57-0x000001AF20A10000-0x000001AF20A20000-memory.dmp
memory/2236-61-0x000001AF20A20000-0x000001AF20A30000-memory.dmp
memory/2236-60-0x000001AF20980000-0x000001AF20990000-memory.dmp
memory/2236-64-0x000001AF20A30000-0x000001AF20A40000-memory.dmp
memory/2236-63-0x000001AF20990000-0x000001AF209A0000-memory.dmp
memory/2236-68-0x000001AF20A40000-0x000001AF20A50000-memory.dmp
memory/2236-66-0x000001AF209B0000-0x000001AF209C0000-memory.dmp
memory/2236-69-0x000001AF20A50000-0x000001AF20A60000-memory.dmp
memory/2236-65-0x000001AF209A0000-0x000001AF209B0000-memory.dmp
memory/2236-71-0x000001AF209D0000-0x000001AF209E0000-memory.dmp
memory/2236-72-0x000001AF20A60000-0x000001AF20A70000-memory.dmp
memory/2236-75-0x000001AF20A70000-0x000001AF20A80000-memory.dmp
memory/2236-78-0x000001AF1EDD0000-0x000001AF1EDD1000-memory.dmp
memory/2236-79-0x000001AF209E0000-0x000001AF209F0000-memory.dmp
memory/2236-80-0x000001AF20A80000-0x000001AF20A90000-memory.dmp
memory/2236-81-0x000001AF1EDD0000-0x000001AF1EDD1000-memory.dmp
memory/2236-83-0x000001AF209F0000-0x000001AF20A00000-memory.dmp
memory/2236-84-0x000001AF20A90000-0x000001AF20AA0000-memory.dmp
memory/2236-88-0x000001AF20A00000-0x000001AF20A10000-memory.dmp
memory/2236-89-0x000001AF20AA0000-0x000001AF20AB0000-memory.dmp
memory/2236-92-0x000001AF20A10000-0x000001AF20A20000-memory.dmp
memory/2236-93-0x000001AF20AB0000-0x000001AF20AC0000-memory.dmp
memory/2236-94-0x000001AF20A20000-0x000001AF20A30000-memory.dmp
memory/2236-95-0x000001AF20AC0000-0x000001AF20AD0000-memory.dmp
memory/2236-97-0x000001AF20A30000-0x000001AF20A40000-memory.dmp
memory/2236-98-0x000001AF20AD0000-0x000001AF20AE0000-memory.dmp
memory/2236-105-0x000001AF20B00000-0x000001AF20B10000-memory.dmp
memory/2236-106-0x000001AF20A50000-0x000001AF20A60000-memory.dmp
memory/2236-104-0x000001AF20AF0000-0x000001AF20B00000-memory.dmp
memory/2236-103-0x000001AF20AE0000-0x000001AF20AF0000-memory.dmp
memory/2236-102-0x000001AF20A40000-0x000001AF20A50000-memory.dmp
memory/2236-113-0x000001AF20B10000-0x000001AF20B20000-memory.dmp
memory/2236-112-0x000001AF20A60000-0x000001AF20A70000-memory.dmp
memory/2236-115-0x000001AF20A70000-0x000001AF20A80000-memory.dmp
memory/2236-116-0x000001AF20B20000-0x000001AF20B30000-memory.dmp
memory/2236-119-0x000001AF20B30000-0x000001AF20B40000-memory.dmp
memory/2236-118-0x000001AF20A80000-0x000001AF20A90000-memory.dmp
memory/2236-121-0x000001AF20A90000-0x000001AF20AA0000-memory.dmp
memory/2236-30-0x000001AF20980000-0x000001AF20990000-memory.dmp
memory/2236-126-0x000001AF20B50000-0x000001AF20B60000-memory.dmp
memory/2236-124-0x000001AF20AA0000-0x000001AF20AB0000-memory.dmp
memory/2236-127-0x000001AF20AB0000-0x000001AF20AC0000-memory.dmp
memory/2236-36-0x000001AF209B0000-0x000001AF209C0000-memory.dmp
memory/2236-128-0x000001AF20B60000-0x000001AF20B70000-memory.dmp
memory/2236-11-0x000001AF206D0000-0x000001AF20940000-memory.dmp
memory/2236-131-0x000001AF20AC0000-0x000001AF20AD0000-memory.dmp
memory/2236-135-0x000001AF1EDD0000-0x000001AF1EDD1000-memory.dmp
memory/2236-140-0x000001AF20B80000-0x000001AF20B90000-memory.dmp
memory/2236-139-0x000001AF20AD0000-0x000001AF20AE0000-memory.dmp
memory/2236-144-0x000001AF20B90000-0x000001AF20BA0000-memory.dmp
memory/2236-143-0x000001AF20B00000-0x000001AF20B10000-memory.dmp
memory/2236-142-0x000001AF20AF0000-0x000001AF20B00000-memory.dmp
memory/2236-141-0x000001AF20AE0000-0x000001AF20AF0000-memory.dmp
memory/2236-149-0x000001AF20BA0000-0x000001AF20BB0000-memory.dmp
memory/2236-154-0x000001AF1EDD0000-0x000001AF1EDD1000-memory.dmp
memory/2236-156-0x000001AF20B10000-0x000001AF20B20000-memory.dmp
memory/2236-157-0x000001AF20B20000-0x000001AF20B30000-memory.dmp
memory/2236-158-0x000001AF20B30000-0x000001AF20B40000-memory.dmp
memory/2236-160-0x000001AF1EDD0000-0x000001AF1EDD1000-memory.dmp
memory/2236-161-0x000001AF1EDD0000-0x000001AF1EDD1000-memory.dmp
memory/2236-163-0x000001AF1EE50000-0x000001AF1EE5C000-memory.dmp
memory/2236-162-0x000001AF1ED60000-0x000001AF1ED91000-memory.dmp
memory/2236-130-0x000001AF1EDD0000-0x000001AF1EDD1000-memory.dmp
memory/2236-182-0x000001AF20A80000-0x000001AF20A90000-memory.dmp
memory/2236-181-0x000001AF20A70000-0x000001AF20A80000-memory.dmp
memory/2236-180-0x000001AF20A60000-0x000001AF20A70000-memory.dmp
memory/2236-179-0x000001AF20A50000-0x000001AF20A60000-memory.dmp
memory/2236-178-0x000001AF20A40000-0x000001AF20A50000-memory.dmp
memory/2236-177-0x000001AF20A20000-0x000001AF20A30000-memory.dmp
memory/2236-176-0x000001AF20A00000-0x000001AF20A10000-memory.dmp
memory/2236-175-0x000001AF209F0000-0x000001AF20A00000-memory.dmp
memory/2236-174-0x000001AF209E0000-0x000001AF209F0000-memory.dmp
memory/2236-173-0x000001AF209D0000-0x000001AF209E0000-memory.dmp
memory/2236-172-0x000001AF209C0000-0x000001AF209D0000-memory.dmp
memory/2236-171-0x000001AF209B0000-0x000001AF209C0000-memory.dmp
memory/2236-170-0x000001AF209A0000-0x000001AF209B0000-memory.dmp
memory/2236-169-0x000001AF20990000-0x000001AF209A0000-memory.dmp
memory/2236-168-0x000001AF20980000-0x000001AF20990000-memory.dmp
memory/2236-167-0x000001AF20970000-0x000001AF20980000-memory.dmp
memory/2236-166-0x000001AF20960000-0x000001AF20970000-memory.dmp
memory/2236-165-0x000001AF20950000-0x000001AF20960000-memory.dmp
memory/2236-164-0x000001AF206D0000-0x000001AF20940000-memory.dmp
memory/2236-27-0x000001AF20960000-0x000001AF20970000-memory.dmp
memory/2236-28-0x000001AF20970000-0x000001AF20980000-memory.dmp
memory/2236-20-0x000001AF1EDD0000-0x000001AF1EDD1000-memory.dmp
memory/2236-132-0x000001AF20B70000-0x000001AF20B80000-memory.dmp
memory/2236-22-0x000001AF20940000-0x000001AF20950000-memory.dmp
memory/2236-24-0x000001AF20950000-0x000001AF20960000-memory.dmp
memory/2616-8-0x00007FF81DBD0000-0x00007FF81E571000-memory.dmp
memory/2616-7-0x000001BBB5AB0000-0x000001BBB5ABC000-memory.dmp
memory/2616-6-0x000001BBB44B0000-0x000001BBB44E1000-memory.dmp
memory/2616-0-0x00007FF81DE85000-0x00007FF81DE86000-memory.dmp
memory/2616-3-0x00007FF81DBD0000-0x00007FF81E571000-memory.dmp
memory/2616-2-0x00007FF81DBD0000-0x00007FF81E571000-memory.dmp
memory/3060-247-0x000002628AC60000-0x000002628AC91000-memory.dmp
memory/3060-230-0x000002628AA00000-0x000002628AA01000-memory.dmp
memory/3060-248-0x00000262A6EC0000-0x00000262A6ECC000-memory.dmp
memory/3060-246-0x000002628AA00000-0x000002628AA01000-memory.dmp
memory/3220-289-0x000001C9FFFE0000-0x000001C9FFFEC000-memory.dmp
memory/3220-288-0x000001C9F53F0000-0x000001C9F5421000-memory.dmp
memory/3220-274-0x000001C9F6A00000-0x000001C9F6A01000-memory.dmp