Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/06/2026, 15:24
General
- Target Request For Quotation.js
- Size 829KB
- Sample260622-stdqxsdz8x
- SHA256 44a3477764d14c4fb57b11de1382f282b2f7593bd2185194d85a2c6bd266a65b
Malware Config
Signatures
- Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\tucortov.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\tucortov.txt"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tucortov.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tucortov.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\tucortov.txt"4⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list6⤵
-
-
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\tucortov.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\tucortov.txt"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
jna3185913215693287819.dll
83aa4cc77f591dfc2374580bbd95f6ba_9671c590-9ebe-4ed2-8bc3-c4b57224adce
tucortov.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1076-6-0x00007FF8AA6F0000-0x00007FF8AB091000-memory.dmp
memory/1076-3-0x00007FF8AA6F0000-0x00007FF8AB091000-memory.dmp
memory/1076-1-0x00007FF8AA6F0000-0x00007FF8AB091000-memory.dmp
memory/1076-0-0x00007FF8AA9A5000-0x00007FF8AA9A6000-memory.dmp
memory/1204-311-0x000002615CFA0000-0x000002615CFA1000-memory.dmp
memory/2744-109-0x0000022380430000-0x0000022380440000-memory.dmp
memory/2744-124-0x0000022380470000-0x0000022380480000-memory.dmp
memory/2744-35-0x00000223802E0000-0x00000223802F0000-memory.dmp
memory/2744-38-0x00000223802F0000-0x0000022380300000-memory.dmp
memory/2744-37-0x0000022380000000-0x0000022380270000-memory.dmp
memory/2744-43-0x00000223FD0D0000-0x00000223FD0D1000-memory.dmp
memory/2744-45-0x0000022380300000-0x0000022380310000-memory.dmp
memory/2744-44-0x0000022380270000-0x0000022380280000-memory.dmp
memory/2744-48-0x0000022380310000-0x0000022380320000-memory.dmp
memory/2744-50-0x0000022380280000-0x0000022380290000-memory.dmp
memory/2744-49-0x0000022380320000-0x0000022380330000-memory.dmp
memory/2744-53-0x0000022380330000-0x0000022380340000-memory.dmp
memory/2744-52-0x0000022380290000-0x00000223802A0000-memory.dmp
memory/2744-62-0x00000223802C0000-0x00000223802D0000-memory.dmp
memory/2744-61-0x00000223802B0000-0x00000223802C0000-memory.dmp
memory/2744-64-0x0000022380370000-0x0000022380380000-memory.dmp
memory/2744-60-0x0000022380360000-0x0000022380370000-memory.dmp
memory/2744-59-0x0000022380350000-0x0000022380360000-memory.dmp
memory/2744-58-0x0000022380340000-0x0000022380350000-memory.dmp
memory/2744-57-0x00000223802A0000-0x00000223802B0000-memory.dmp
memory/2744-68-0x00000223802D0000-0x00000223802E0000-memory.dmp
memory/2744-69-0x00000223802E0000-0x00000223802F0000-memory.dmp
memory/2744-70-0x0000022380380000-0x0000022380390000-memory.dmp
memory/2744-72-0x0000022380390000-0x00000223803A0000-memory.dmp
memory/2744-77-0x00000223803A0000-0x00000223803B0000-memory.dmp
memory/2744-76-0x00000223802F0000-0x0000022380300000-memory.dmp
memory/2744-85-0x0000022380320000-0x0000022380330000-memory.dmp
memory/2744-84-0x0000022380310000-0x0000022380320000-memory.dmp
memory/2744-83-0x00000223803C0000-0x00000223803D0000-memory.dmp
memory/2744-82-0x00000223803B0000-0x00000223803C0000-memory.dmp
memory/2744-81-0x0000022380300000-0x0000022380310000-memory.dmp
memory/2744-88-0x00000223803D0000-0x00000223803E0000-memory.dmp
memory/2744-91-0x00000223803E0000-0x00000223803F0000-memory.dmp
memory/2744-90-0x0000022380330000-0x0000022380340000-memory.dmp
memory/2744-97-0x0000022380400000-0x0000022380410000-memory.dmp
memory/2744-96-0x00000223803F0000-0x0000022380400000-memory.dmp
memory/2744-95-0x0000022380360000-0x0000022380370000-memory.dmp
memory/2744-94-0x0000022380350000-0x0000022380360000-memory.dmp
memory/2744-93-0x0000022380340000-0x0000022380350000-memory.dmp
memory/2744-103-0x0000022380410000-0x0000022380420000-memory.dmp
memory/2744-102-0x0000022380370000-0x0000022380380000-memory.dmp
memory/2744-105-0x0000022380380000-0x0000022380390000-memory.dmp
memory/2744-106-0x0000022380420000-0x0000022380430000-memory.dmp
memory/2744-29-0x00000223802B0000-0x00000223802C0000-memory.dmp
memory/2744-108-0x0000022380390000-0x00000223803A0000-memory.dmp
memory/2744-112-0x0000022380440000-0x0000022380450000-memory.dmp
memory/2744-111-0x00000223803A0000-0x00000223803B0000-memory.dmp
memory/2744-116-0x0000022380450000-0x0000022380460000-memory.dmp
memory/2744-115-0x00000223803C0000-0x00000223803D0000-memory.dmp
memory/2744-114-0x00000223803B0000-0x00000223803C0000-memory.dmp
memory/2744-125-0x00000223803D0000-0x00000223803E0000-memory.dmp
memory/2744-34-0x00000223802D0000-0x00000223802E0000-memory.dmp
memory/2744-123-0x0000022380460000-0x0000022380470000-memory.dmp
memory/2744-119-0x00000223FD0D0000-0x00000223FD0D1000-memory.dmp
memory/2744-132-0x0000022380400000-0x0000022380410000-memory.dmp
memory/2744-131-0x00000223803F0000-0x0000022380400000-memory.dmp
memory/2744-130-0x0000022380490000-0x00000223804A0000-memory.dmp
memory/2744-129-0x0000022380480000-0x0000022380490000-memory.dmp
memory/2744-128-0x00000223803E0000-0x00000223803F0000-memory.dmp
memory/2744-137-0x00000223804A0000-0x00000223804B0000-memory.dmp
memory/2744-136-0x00000223FD0D0000-0x00000223FD0D1000-memory.dmp
memory/2744-144-0x00000223804B0000-0x00000223804C0000-memory.dmp
memory/2744-143-0x0000022380410000-0x0000022380420000-memory.dmp
memory/2744-146-0x00000223FD0D0000-0x00000223FD0D1000-memory.dmp
memory/2744-149-0x0000022380420000-0x0000022380430000-memory.dmp
memory/2744-150-0x0000022380430000-0x0000022380440000-memory.dmp
memory/2744-153-0x00000223FD0D0000-0x00000223FD0D1000-memory.dmp
memory/2744-154-0x0000022380000000-0x0000022380270000-memory.dmp
memory/2744-162-0x00000223802F0000-0x0000022380300000-memory.dmp
memory/2744-177-0x00000223803E0000-0x00000223803F0000-memory.dmp
memory/2744-176-0x00000223803D0000-0x00000223803E0000-memory.dmp
memory/2744-175-0x00000223803C0000-0x00000223803D0000-memory.dmp
memory/2744-174-0x00000223803B0000-0x00000223803C0000-memory.dmp
memory/2744-173-0x00000223803A0000-0x00000223803B0000-memory.dmp
memory/2744-172-0x0000022380390000-0x00000223803A0000-memory.dmp
memory/2744-171-0x0000022380380000-0x0000022380390000-memory.dmp
memory/2744-170-0x0000022380370000-0x0000022380380000-memory.dmp
memory/2744-169-0x0000022380360000-0x0000022380370000-memory.dmp
memory/2744-168-0x0000022380350000-0x0000022380360000-memory.dmp
memory/2744-167-0x0000022380340000-0x0000022380350000-memory.dmp
memory/2744-166-0x0000022380330000-0x0000022380340000-memory.dmp
memory/2744-165-0x0000022380320000-0x0000022380330000-memory.dmp
memory/2744-164-0x0000022380310000-0x0000022380320000-memory.dmp
memory/2744-163-0x0000022380300000-0x0000022380310000-memory.dmp
memory/2744-161-0x00000223802E0000-0x00000223802F0000-memory.dmp
memory/2744-160-0x00000223802D0000-0x00000223802E0000-memory.dmp
memory/2744-159-0x00000223802C0000-0x00000223802D0000-memory.dmp
memory/2744-158-0x00000223802B0000-0x00000223802C0000-memory.dmp
memory/2744-157-0x00000223802A0000-0x00000223802B0000-memory.dmp
memory/2744-30-0x00000223802C0000-0x00000223802D0000-memory.dmp
memory/2744-26-0x00000223802A0000-0x00000223802B0000-memory.dmp
memory/2744-156-0x0000022380290000-0x00000223802A0000-memory.dmp
memory/2744-155-0x0000022380270000-0x0000022380280000-memory.dmp
memory/2744-9-0x0000022380000000-0x0000022380270000-memory.dmp
memory/2744-24-0x0000022380290000-0x00000223802A0000-memory.dmp
memory/2744-22-0x0000022380280000-0x0000022380290000-memory.dmp
memory/2744-18-0x00000223FD0D0000-0x00000223FD0D1000-memory.dmp
memory/2744-21-0x0000022380270000-0x0000022380280000-memory.dmp
memory/3464-255-0x000001BE4AD50000-0x000001BE4AD51000-memory.dmp
memory/3464-286-0x000001BE4AD50000-0x000001BE4AD51000-memory.dmp
memory/3764-238-0x000001C67FCE0000-0x000001C67FCE1000-memory.dmp
memory/3764-205-0x000001C67FCE0000-0x000001C67FCE1000-memory.dmp