Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 13:34
General
- Target e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0.exe
- Size 568KB
- Sample260810-qvecqsak61
- SHA256 e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0
Malware Config
Extracted
-
strrat
-
newlife4sm.duckdns.org:2028
-
oldsm.duckdns.org:2028
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0.exe"C:\Users\Admin\AppData\Local\Temp\e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\julyjavgrace.jar"2⤵
-
-
C:\Windows\System32\RuntimeBroker.exe"C:\Windows\System32\RuntimeBroker.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
julyjavgrace.jar
memory/2384-517-0x000001A1CE2C0000-0x000001A1CE2DE000-memory.dmp
memory/2384-524-0x000001A1CE620000-0x000001A1CE644000-memory.dmp
memory/2384-520-0x000001A1CE620000-0x000001A1CE644000-memory.dmp
memory/2384-521-0x000001A1CE620000-0x000001A1CE644000-memory.dmp
memory/2384-522-0x000001A1CE620000-0x000001A1CE644000-memory.dmp
memory/2384-523-0x000001A1CE620000-0x000001A1CE644000-memory.dmp
memory/4316-515-0x000001D22DE30000-0x000001D22DE78000-memory.dmp
memory/4316-518-0x000001D22DE30000-0x000001D22DE78000-memory.dmp
memory/4316-0-0x000001D22DD00000-0x000001D22DD80000-memory.dmp
memory/4316-511-0x000001D22DE30000-0x000001D22DE78000-memory.dmp
memory/4316-527-0x000001D22DE30000-0x000001D22DE78000-memory.dmp
memory/4316-504-0x000001D22DE30000-0x000001D22DE78000-memory.dmp
memory/4316-500-0x000001D22DD00000-0x000001D22DD04000-memory.dmp
memory/4708-534-0x000001C66AA60000-0x000001C66AA61000-memory.dmp