Analysis
- max time kernel
299s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 15:05
General
- Target REQUEST FOR QUOTATION.js
- Size 829KB
- Sample260922-sgathagh75
- SHA256 28d598f922d5dfaf4053c59af1ebd46f21133c33d58121ef95590bf80fe9ef22
Malware Config
Extracted
-
strrat
-
jetos.2waky.com:3609
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Opens file in notepad (likely ransom note) 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dkqrtucngx.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\dkqrtucngx.txt"3⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\dkqrtucngx.txt"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\dkqrtucngx.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\dkqrtucngx.txt"4⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\dkqrtucngx.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\dkqrtucngx.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
jna5434774576241511861.dll
83aa4cc77f591dfc2374580bbd95f6ba_71306956-741d-496c-97c6-468adc86abdb
dkqrtucngx.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1096-296-0x0000022089FA0000-0x0000022089FA1000-memory.dmp
memory/1096-279-0x0000022089FA0000-0x0000022089FA1000-memory.dmp
memory/1096-262-0x0000022089FA0000-0x0000022089FA1000-memory.dmp
memory/2332-133-0x0000028AC3920000-0x0000028AC3930000-memory.dmp
memory/2332-59-0x0000028AC3810000-0x0000028AC3820000-memory.dmp
memory/2332-44-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-47-0x0000028AC37D0000-0x0000028AC37E0000-memory.dmp
memory/2332-46-0x0000028AC3730000-0x0000028AC3740000-memory.dmp
memory/2332-50-0x0000028AC37E0000-0x0000028AC37F0000-memory.dmp
memory/2332-49-0x0000028AC3740000-0x0000028AC3750000-memory.dmp
memory/2332-52-0x0000028AC3750000-0x0000028AC3760000-memory.dmp
memory/2332-53-0x0000028AC37F0000-0x0000028AC3800000-memory.dmp
memory/2332-55-0x0000028AC3760000-0x0000028AC3770000-memory.dmp
memory/2332-56-0x0000028AC3800000-0x0000028AC3810000-memory.dmp
memory/2332-152-0x0000028AC38E0000-0x0000028AC38F0000-memory.dmp
memory/2332-58-0x0000028AC3770000-0x0000028AC3780000-memory.dmp
memory/2332-62-0x0000028AC3820000-0x0000028AC3830000-memory.dmp
memory/2332-61-0x0000028AC3780000-0x0000028AC3790000-memory.dmp
memory/2332-64-0x0000028AC3790000-0x0000028AC37A0000-memory.dmp
memory/2332-66-0x0000028AC3830000-0x0000028AC3840000-memory.dmp
memory/2332-68-0x0000028AC3840000-0x0000028AC3850000-memory.dmp
memory/2332-67-0x0000028AC37A0000-0x0000028AC37B0000-memory.dmp
memory/2332-72-0x0000028AC3850000-0x0000028AC3860000-memory.dmp
memory/2332-71-0x0000028AC37B0000-0x0000028AC37C0000-memory.dmp
memory/2332-78-0x0000028AC37D0000-0x0000028AC37E0000-memory.dmp
memory/2332-77-0x0000028AC3860000-0x0000028AC3870000-memory.dmp
memory/2332-76-0x0000028AC37C0000-0x0000028AC37D0000-memory.dmp
memory/2332-79-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-82-0x0000028AC37E0000-0x0000028AC37F0000-memory.dmp
memory/2332-83-0x0000028AC3870000-0x0000028AC3880000-memory.dmp
memory/2332-89-0x0000028AC3800000-0x0000028AC3810000-memory.dmp
memory/2332-88-0x0000028AC3890000-0x0000028AC38A0000-memory.dmp
memory/2332-91-0x0000028AC3810000-0x0000028AC3820000-memory.dmp
memory/2332-92-0x0000028AC38A0000-0x0000028AC38B0000-memory.dmp
memory/2332-87-0x0000028AC3880000-0x0000028AC3890000-memory.dmp
memory/2332-86-0x0000028AC37F0000-0x0000028AC3800000-memory.dmp
memory/2332-95-0x0000028AC38B0000-0x0000028AC38C0000-memory.dmp
memory/2332-94-0x0000028AC3820000-0x0000028AC3830000-memory.dmp
memory/2332-97-0x0000028AC3830000-0x0000028AC3840000-memory.dmp
memory/2332-98-0x0000028AC38C0000-0x0000028AC38D0000-memory.dmp
memory/2332-105-0x0000028AC3850000-0x0000028AC3860000-memory.dmp
memory/2332-104-0x0000028AC38E0000-0x0000028AC38F0000-memory.dmp
memory/2332-103-0x0000028AC38D0000-0x0000028AC38E0000-memory.dmp
memory/2332-102-0x0000028AC3840000-0x0000028AC3850000-memory.dmp
memory/2332-107-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-116-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-113-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-120-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-122-0x0000028AC3860000-0x0000028AC3870000-memory.dmp
memory/2332-123-0x0000028AC38F0000-0x0000028AC3900000-memory.dmp
memory/2332-124-0x0000028AC3860000-0x0000028AC3870000-memory.dmp
memory/2332-126-0x0000028AC3870000-0x0000028AC3880000-memory.dmp
memory/2332-127-0x0000028AC3900000-0x0000028AC3910000-memory.dmp
memory/2332-129-0x0000028AC3880000-0x0000028AC3890000-memory.dmp
memory/2332-131-0x0000028AC3910000-0x0000028AC3920000-memory.dmp
memory/2332-138-0x0000028AC38B0000-0x0000028AC38C0000-memory.dmp
memory/2332-137-0x0000028AC3930000-0x0000028AC3940000-memory.dmp
memory/2332-140-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-139-0x0000028AC3940000-0x0000028AC3950000-memory.dmp
memory/2332-37-0x0000028AC37B0000-0x0000028AC37C0000-memory.dmp
memory/2332-43-0x0000028AC37C0000-0x0000028AC37D0000-memory.dmp
memory/2332-175-0x0000028AC3980000-0x0000028AC3990000-memory.dmp
memory/2332-150-0x0000028AC3960000-0x0000028AC3970000-memory.dmp
memory/2332-149-0x0000028AC3950000-0x0000028AC3960000-memory.dmp
memory/2332-148-0x0000028AC38C0000-0x0000028AC38D0000-memory.dmp
memory/2332-130-0x0000028AC3890000-0x0000028AC38A0000-memory.dmp
memory/2332-136-0x0000028AC38A0000-0x0000028AC38B0000-memory.dmp
memory/2332-153-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-154-0x0000028AC38F0000-0x0000028AC3900000-memory.dmp
memory/2332-155-0x0000028AC3900000-0x0000028AC3910000-memory.dmp
memory/2332-156-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-159-0x0000028AC3910000-0x0000028AC3920000-memory.dmp
memory/2332-160-0x0000028AC3920000-0x0000028AC3930000-memory.dmp
memory/2332-161-0x0000028AC3930000-0x0000028AC3940000-memory.dmp
memory/2332-162-0x0000028AC3940000-0x0000028AC3950000-memory.dmp
memory/2332-163-0x0000028AC3950000-0x0000028AC3960000-memory.dmp
memory/2332-164-0x0000028AC3960000-0x0000028AC3970000-memory.dmp
memory/2332-168-0x0000028AC3970000-0x0000028AC3980000-memory.dmp
memory/2332-170-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-151-0x0000028AC38D0000-0x0000028AC38E0000-memory.dmp
memory/2332-177-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-178-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-179-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-188-0x0000028AC3970000-0x0000028AC3980000-memory.dmp
memory/2332-189-0x0000028AC3980000-0x0000028AC3990000-memory.dmp
memory/2332-192-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-193-0x0000028AC3990000-0x0000028AC39A0000-memory.dmp
memory/2332-195-0x0000028AC39A0000-0x0000028AC39B0000-memory.dmp
memory/2332-197-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-202-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-204-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-209-0x0000028AC3760000-0x0000028AC3770000-memory.dmp
memory/2332-213-0x0000028AC37A0000-0x0000028AC37B0000-memory.dmp
memory/2332-215-0x0000028AC3860000-0x0000028AC3870000-memory.dmp
memory/2332-214-0x0000028AC37B0000-0x0000028AC37C0000-memory.dmp
memory/2332-212-0x0000028AC3790000-0x0000028AC37A0000-memory.dmp
memory/2332-211-0x0000028AC3780000-0x0000028AC3790000-memory.dmp
memory/2332-210-0x0000028AC3770000-0x0000028AC3780000-memory.dmp
memory/2332-208-0x0000028AC3750000-0x0000028AC3760000-memory.dmp
memory/2332-207-0x0000028AC3740000-0x0000028AC3750000-memory.dmp
memory/2332-206-0x0000028AC3730000-0x0000028AC3740000-memory.dmp
memory/2332-205-0x0000028AC34C0000-0x0000028AC3730000-memory.dmp
memory/2332-36-0x0000028AC34C0000-0x0000028AC3730000-memory.dmp
memory/2332-34-0x0000028AC37A0000-0x0000028AC37B0000-memory.dmp
memory/2332-32-0x0000028AC3790000-0x0000028AC37A0000-memory.dmp
memory/2332-30-0x0000028AC3780000-0x0000028AC3790000-memory.dmp
memory/2332-28-0x0000028AC3770000-0x0000028AC3780000-memory.dmp
memory/2332-26-0x0000028AC3760000-0x0000028AC3770000-memory.dmp
memory/2332-24-0x0000028AC3750000-0x0000028AC3760000-memory.dmp
memory/2332-22-0x0000028AC3740000-0x0000028AC3750000-memory.dmp
memory/2332-20-0x0000028AC3730000-0x0000028AC3740000-memory.dmp
memory/2332-17-0x0000028AC1B30000-0x0000028AC1B31000-memory.dmp
memory/2332-16-0x0000028AC34C0000-0x0000028AC3730000-memory.dmp
memory/2376-0-0x00007FF9F084A000-0x00007FF9F084B000-memory.dmp
memory/2376-1-0x00007FF9F0550000-0x00007FF9F0F88000-memory.dmp
memory/2376-3-0x00007FF9F0550000-0x00007FF9F0F88000-memory.dmp
memory/2376-5-0x00007FF9F0550000-0x00007FF9F0F88000-memory.dmp
memory/5588-313-0x00000284C8CC0000-0x00000284C8CC1000-memory.dmp
memory/5588-314-0x00000284C8CC0000-0x00000284C8CC1000-memory.dmp