Analysis
- max time kernel
298s - max time network
298s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 00:04
General
- Target Presupuesto.jar
- Size 97KB
- Sample260925-ac3plstt3q
- SHA256 a11d6fd888f36376d769e549a7b4aafa11328d70a7b13fe99997ac7b4e383834
Malware Config
Extracted
-
strrat
-
elastsolek1.duckdns.org:4787
-
zekeriyasolek44.duckdns.org:4787
-
license_id
WFC9-W4KB-388F-9KY1-S6JV
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
- Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Adds Run key to start application 2 TTPs 2 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Presupuesto.jar1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Presupuesto.jar"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Presupuesto.jar"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Presupuesto.jar"2⤵
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\Presupuesto.jar"1⤵
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\Presupuesto.jar"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Presupuesto.jar
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
memory/1624-41-0x000001CD4E050000-0x000001CD4E060000-memory.dmp
memory/1624-45-0x000001CD4E090000-0x000001CD4E0A0000-memory.dmp
memory/1624-23-0x000001CD4E080000-0x000001CD4E090000-memory.dmp
memory/1624-22-0x000001CD4E070000-0x000001CD4E080000-memory.dmp
memory/1624-25-0x000001CD4E090000-0x000001CD4E0A0000-memory.dmp
memory/1624-27-0x000001CD4E0A0000-0x000001CD4E0B0000-memory.dmp
memory/1624-17-0x000001CD4E050000-0x000001CD4E060000-memory.dmp
memory/1624-35-0x000001CD4E0B0000-0x000001CD4E0C0000-memory.dmp
memory/1624-34-0x000001CD4DDC0000-0x000001CD4E030000-memory.dmp
memory/1624-44-0x000001CD4E080000-0x000001CD4E090000-memory.dmp
memory/1624-2-0x000001CD4DDC0000-0x000001CD4E030000-memory.dmp
memory/1624-39-0x000001CD4E030000-0x000001CD4E040000-memory.dmp
memory/1624-46-0x000001CD4E0A0000-0x000001CD4E0B0000-memory.dmp
memory/1624-19-0x000001CD4E060000-0x000001CD4E070000-memory.dmp
memory/1624-43-0x000001CD4E070000-0x000001CD4E080000-memory.dmp
memory/1624-42-0x000001CD4E060000-0x000001CD4E070000-memory.dmp
memory/1624-40-0x000001CD4E040000-0x000001CD4E050000-memory.dmp
memory/1624-38-0x000001CD4DDC0000-0x000001CD4E030000-memory.dmp
memory/1624-11-0x000001CD4DC50000-0x000001CD4DC51000-memory.dmp
memory/1624-15-0x000001CD4E040000-0x000001CD4E050000-memory.dmp
memory/1624-13-0x000001CD4E030000-0x000001CD4E040000-memory.dmp
memory/1780-94-0x000002093D1E0000-0x000002093D1E1000-memory.dmp
memory/4136-83-0x000001DCCCA80000-0x000001DCCCA81000-memory.dmp
memory/4796-64-0x00000192F7300000-0x00000192F7301000-memory.dmp
memory/4796-50-0x0000019280000000-0x0000019280270000-memory.dmp
memory/4796-120-0x0000019280000000-0x0000019280270000-memory.dmp