Analysis
- max time kernel
299s - max time network
238s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/09/2026, 15:05
General
- Target REQUEST FOR QUOTATION.js
- Size 829KB
- Sample260922-sgathagh75
- SHA256 28d598f922d5dfaf4053c59af1ebd46f21133c33d58121ef95590bf80fe9ef22
Malware Config
Extracted
-
strrat
-
jetos.2waky.com:3609
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Opens file in notepad (likely ransom note) 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\gzlacmb.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\gzlacmb.txt"3⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\gzlacmb.txt"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\gzlacmb.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\gzlacmb.txt"4⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\gzlacmb.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\gzlacmb.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
jna8006575251656471040.dll
83aa4cc77f591dfc2374580bbd95f6ba_864ddaf1-1968-4ead-9c86-62acd3ec3075
gzlacmb.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1604-298-0x000001A198160000-0x000001A198161000-memory.dmp
memory/2360-6-0x00007FFAFD4F0000-0x00007FFAFDE91000-memory.dmp
memory/2360-4-0x00007FFAFD4F0000-0x00007FFAFDE91000-memory.dmp
memory/2360-2-0x00007FFAFD4F0000-0x00007FFAFDE91000-memory.dmp
memory/2360-0-0x00007FFAFD7A5000-0x00007FFAFD7A6000-memory.dmp
memory/4332-281-0x000001D393680000-0x000001D393681000-memory.dmp
memory/4332-248-0x000001D393680000-0x000001D393681000-memory.dmp
memory/4608-108-0x0000014C69CC0000-0x0000014C69CD0000-memory.dmp
memory/4608-126-0x0000014C69C70000-0x0000014C69C80000-memory.dmp
memory/4608-35-0x0000014C69B70000-0x0000014C69B80000-memory.dmp
memory/4608-34-0x0000014C69B60000-0x0000014C69B70000-memory.dmp
memory/4608-37-0x0000014C69B80000-0x0000014C69B90000-memory.dmp
memory/4608-43-0x0000014C69B90000-0x0000014C69BA0000-memory.dmp
memory/4608-44-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-47-0x0000014C69BA0000-0x0000014C69BB0000-memory.dmp
memory/4608-46-0x0000014C69B00000-0x0000014C69B10000-memory.dmp
memory/4608-49-0x0000014C69B10000-0x0000014C69B20000-memory.dmp
memory/4608-50-0x0000014C69BB0000-0x0000014C69BC0000-memory.dmp
memory/4608-53-0x0000014C69BC0000-0x0000014C69BD0000-memory.dmp
memory/4608-52-0x0000014C69B20000-0x0000014C69B30000-memory.dmp
memory/4608-56-0x0000014C69BD0000-0x0000014C69BE0000-memory.dmp
memory/4608-55-0x0000014C69B30000-0x0000014C69B40000-memory.dmp
memory/4608-60-0x0000014C69BE0000-0x0000014C69BF0000-memory.dmp
memory/4608-59-0x0000014C69B50000-0x0000014C69B60000-memory.dmp
memory/4608-58-0x0000014C69B40000-0x0000014C69B50000-memory.dmp
memory/4608-66-0x0000014C69B70000-0x0000014C69B80000-memory.dmp
memory/4608-65-0x0000014C69B60000-0x0000014C69B70000-memory.dmp
memory/4608-64-0x0000014C69C00000-0x0000014C69C10000-memory.dmp
memory/4608-63-0x0000014C69BF0000-0x0000014C69C00000-memory.dmp
memory/4608-70-0x0000014C69C10000-0x0000014C69C20000-memory.dmp
memory/4608-72-0x0000014C69B80000-0x0000014C69B90000-memory.dmp
memory/4608-71-0x0000014C69C20000-0x0000014C69C30000-memory.dmp
memory/4608-75-0x0000014C69C30000-0x0000014C69C40000-memory.dmp
memory/4608-74-0x0000014C69B90000-0x0000014C69BA0000-memory.dmp
memory/4608-79-0x0000014C69C40000-0x0000014C69C50000-memory.dmp
memory/4608-78-0x0000014C69BA0000-0x0000014C69BB0000-memory.dmp
memory/4608-85-0x0000014C69C50000-0x0000014C69C60000-memory.dmp
memory/4608-84-0x0000014C69BB0000-0x0000014C69BC0000-memory.dmp
memory/4608-90-0x0000014C69C70000-0x0000014C69C80000-memory.dmp
memory/4608-91-0x0000014C69BD0000-0x0000014C69BE0000-memory.dmp
memory/4608-89-0x0000014C69C60000-0x0000014C69C70000-memory.dmp
memory/4608-88-0x0000014C69BC0000-0x0000014C69BD0000-memory.dmp
memory/4608-94-0x0000014C69C80000-0x0000014C69C90000-memory.dmp
memory/4608-93-0x0000014C69BE0000-0x0000014C69BF0000-memory.dmp
memory/4608-98-0x0000014C69BF0000-0x0000014C69C00000-memory.dmp
memory/4608-102-0x0000014C69C00000-0x0000014C69C10000-memory.dmp
memory/4608-101-0x0000014C69CB0000-0x0000014C69CC0000-memory.dmp
memory/4608-100-0x0000014C69CA0000-0x0000014C69CB0000-memory.dmp
memory/4608-99-0x0000014C69C90000-0x0000014C69CA0000-memory.dmp
memory/4608-29-0x0000014C69B40000-0x0000014C69B50000-memory.dmp
memory/4608-107-0x0000014C69C20000-0x0000014C69C30000-memory.dmp
memory/4608-106-0x0000014C69C10000-0x0000014C69C20000-memory.dmp
memory/4608-110-0x0000014C69CD0000-0x0000014C69CE0000-memory.dmp
memory/4608-111-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-113-0x0000014C69C30000-0x0000014C69C40000-memory.dmp
memory/4608-114-0x0000014C69CE0000-0x0000014C69CF0000-memory.dmp
memory/4608-117-0x0000014C69CF0000-0x0000014C69D00000-memory.dmp
memory/4608-116-0x0000014C69C40000-0x0000014C69C50000-memory.dmp
memory/4608-33-0x0000014C69890000-0x0000014C69B00000-memory.dmp
memory/4608-131-0x0000014C69C80000-0x0000014C69C90000-memory.dmp
memory/4608-130-0x0000014C69D40000-0x0000014C69D50000-memory.dmp
memory/4608-132-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-129-0x0000014C69D30000-0x0000014C69D40000-memory.dmp
memory/4608-125-0x0000014C69C60000-0x0000014C69C70000-memory.dmp
memory/4608-124-0x0000014C69D20000-0x0000014C69D30000-memory.dmp
memory/4608-123-0x0000014C69D10000-0x0000014C69D20000-memory.dmp
memory/4608-122-0x0000014C69D00000-0x0000014C69D10000-memory.dmp
memory/4608-121-0x0000014C69C50000-0x0000014C69C60000-memory.dmp
memory/4608-138-0x0000014C69C90000-0x0000014C69CA0000-memory.dmp
memory/4608-139-0x0000014C69CA0000-0x0000014C69CB0000-memory.dmp
memory/4608-140-0x0000014C69CB0000-0x0000014C69CC0000-memory.dmp
memory/4608-142-0x0000014C69CC0000-0x0000014C69CD0000-memory.dmp
memory/4608-143-0x0000014C69CD0000-0x0000014C69CE0000-memory.dmp
memory/4608-144-0x0000014C69CE0000-0x0000014C69CF0000-memory.dmp
memory/4608-145-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-148-0x0000014C69CF0000-0x0000014C69D00000-memory.dmp
memory/4608-151-0x0000014C69D20000-0x0000014C69D30000-memory.dmp
memory/4608-150-0x0000014C69D10000-0x0000014C69D20000-memory.dmp
memory/4608-149-0x0000014C69D00000-0x0000014C69D10000-memory.dmp
memory/4608-153-0x0000014C69D40000-0x0000014C69D50000-memory.dmp
memory/4608-152-0x0000014C69D30000-0x0000014C69D40000-memory.dmp
memory/4608-157-0x0000014C69D50000-0x0000014C69D60000-memory.dmp
memory/4608-161-0x0000014C69D60000-0x0000014C69D70000-memory.dmp
memory/4608-163-0x0000014C69D70000-0x0000014C69D80000-memory.dmp
memory/4608-165-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-169-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-171-0x0000014C69D50000-0x0000014C69D60000-memory.dmp
memory/4608-172-0x0000014C69D60000-0x0000014C69D70000-memory.dmp
memory/4608-173-0x0000014C69D70000-0x0000014C69D80000-memory.dmp
memory/4608-183-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-187-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-190-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-193-0x0000014C69C00000-0x0000014C69C10000-memory.dmp
memory/4608-198-0x0000014C69B60000-0x0000014C69B70000-memory.dmp
memory/4608-200-0x0000014C69B80000-0x0000014C69B90000-memory.dmp
memory/4608-199-0x0000014C69890000-0x0000014C69B00000-memory.dmp
memory/4608-197-0x0000014C69B50000-0x0000014C69B60000-memory.dmp
memory/4608-196-0x0000014C69B40000-0x0000014C69B50000-memory.dmp
memory/4608-30-0x0000014C69B50000-0x0000014C69B60000-memory.dmp
memory/4608-26-0x0000014C69B30000-0x0000014C69B40000-memory.dmp
memory/4608-24-0x0000014C69B20000-0x0000014C69B30000-memory.dmp
memory/4608-22-0x0000014C69B10000-0x0000014C69B20000-memory.dmp
memory/4608-21-0x0000014C69B00000-0x0000014C69B10000-memory.dmp
memory/4608-18-0x0000014C68070000-0x0000014C68071000-memory.dmp
memory/4608-9-0x0000014C69890000-0x0000014C69B00000-memory.dmp
memory/4608-195-0x0000014C69B30000-0x0000014C69B40000-memory.dmp
memory/4608-194-0x0000014C69B20000-0x0000014C69B30000-memory.dmp
memory/4608-192-0x0000014C69B00000-0x0000014C69B10000-memory.dmp
memory/4608-191-0x0000014C69B10000-0x0000014C69B20000-memory.dmp