strrat | fcadd90eca392474bf5d976638e2e63dda47e44cea9fe312e58828c98b614852

Analysis

max time kernel
298s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TEKLIF-ISTEME-FORMU.pdf.jar
Size 97KB
Sample261014-vg2ckaha83
SHA256 fcadd90eca392474bf5d976638e2e63dda47e44cea9fe312e58828c98b614852
MD5 16e9287bc6462685cb4aa2fd54c60d9d
SHA1 0b3163a6e010ce4a19c30ad890fe4b6f3629cb81
SHA512 b9aec05726195120da52b93f8ba70ba8a87ea0427f722a4e8e72445936334b5ae4545ce264bde186ef990972c7f2f79bb84cc9db91faa919156318dcf24eeb23
SSDEEP 1536:OOAoqshl7hoN0ZXots74RrXRdnntQCqqr0aqR1JLXHU2r5yYxIs:OMq8o6xiygrX7nnqUbq5bHUGwYxIs
TLSH
T15AA3F9947B44D072D72360B60A58E21AA9B8E4EFD25571E70FF0ECBDDC29C010F96AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution strrat persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

strrat

elastsolek1replace.duckdns.org:4787
zekeriyasolek44.duckdns.org:4787

Attributes

license_id
WFC9-W4KB-388F-9KY1-S6JV
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
true
secondary_startup
true
startup
true

Signatures

Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TEKLIF-ISTEME-FORMU.pdf.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TEKLIF-ISTEME-FORMU.pdf = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\TEKLIF-ISTEME-FORMU.pdf.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TEKLIF-ISTEME-FORMU.pdf = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\TEKLIF-ISTEME-FORMU.pdf.jar\""	java.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	ip-api.com

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3364	cmd.exe
1432	cmd.exe
3160	cmd.exe
3992	cmd.exe
1516	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4588	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1904	WMIC.exe
Token: SeSecurityPrivilege	1904	WMIC.exe
Token: SeTakeOwnershipPrivilege	1904	WMIC.exe
Token: SeLoadDriverPrivilege	1904	WMIC.exe
Token: SeSystemProfilePrivilege	1904	WMIC.exe
Token: SeSystemtimePrivilege	1904	WMIC.exe
Token: SeProfSingleProcessPrivilege	1904	WMIC.exe
Token: SeIncBasePriorityPrivilege	1904	WMIC.exe
Token: SeCreatePagefilePrivilege	1904	WMIC.exe
Token: SeBackupPrivilege	1904	WMIC.exe
Token: SeRestorePrivilege	1904	WMIC.exe
Token: SeShutdownPrivilege	1904	WMIC.exe
Token: SeDebugPrivilege	1904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1904	WMIC.exe
Token: SeRemoteShutdownPrivilege	1904	WMIC.exe
Token: SeUndockPrivilege	1904	WMIC.exe
Token: SeManageVolumePrivilege	1904	WMIC.exe
Token: 33	1904	WMIC.exe
Token: 34	1904	WMIC.exe
Token: 35	1904	WMIC.exe
Token: 36	1904	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1904	WMIC.exe
Token: SeSecurityPrivilege	1904	WMIC.exe
Token: SeTakeOwnershipPrivilege	1904	WMIC.exe
Token: SeLoadDriverPrivilege	1904	WMIC.exe
Token: SeSystemProfilePrivilege	1904	WMIC.exe
Token: SeSystemtimePrivilege	1904	WMIC.exe
Token: SeProfSingleProcessPrivilege	1904	WMIC.exe
Token: SeIncBasePriorityPrivilege	1904	WMIC.exe
Token: SeCreatePagefilePrivilege	1904	WMIC.exe
Token: SeBackupPrivilege	1904	WMIC.exe
Token: SeRestorePrivilege	1904	WMIC.exe
Token: SeShutdownPrivilege	1904	WMIC.exe
Token: SeDebugPrivilege	1904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1904	WMIC.exe
Token: SeRemoteShutdownPrivilege	1904	WMIC.exe
Token: SeUndockPrivilege	1904	WMIC.exe
Token: SeManageVolumePrivilege	1904	WMIC.exe
Token: 33	1904	WMIC.exe
Token: 34	1904	WMIC.exe
Token: 35	1904	WMIC.exe
Token: 36	1904	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4560	WMIC.exe
Token: SeSecurityPrivilege	4560	WMIC.exe
Token: SeTakeOwnershipPrivilege	4560	WMIC.exe
Token: SeLoadDriverPrivilege	4560	WMIC.exe
Token: SeSystemProfilePrivilege	4560	WMIC.exe
Token: SeSystemtimePrivilege	4560	WMIC.exe
Token: SeProfSingleProcessPrivilege	4560	WMIC.exe
Token: SeIncBasePriorityPrivilege	4560	WMIC.exe
Token: SeCreatePagefilePrivilege	4560	WMIC.exe
Token: SeBackupPrivilege	4560	WMIC.exe
Token: SeRestorePrivilege	4560	WMIC.exe
Token: SeShutdownPrivilege	4560	WMIC.exe
Token: SeDebugPrivilege	4560	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4560	WMIC.exe
Token: SeRemoteShutdownPrivilege	4560	WMIC.exe
Token: SeUndockPrivilege	4560	WMIC.exe
Token: SeManageVolumePrivilege	4560	WMIC.exe
Token: 33	4560	WMIC.exe
Token: 34	4560	WMIC.exe
Token: 35	4560	WMIC.exe
Token: 36	4560	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4560	WMIC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 3364	1896	java.exe	89
PID 1896 wrote to memory of 2380	1896	java.exe	90
PID 3364 wrote to memory of 4588	3364	cmd.exe	93
PID 2380 wrote to memory of 1432	2380	java.exe	99
PID 1432 wrote to memory of 1904	1432	cmd.exe	102
PID 2380 wrote to memory of 3160	2380	java.exe	105
PID 3160 wrote to memory of 4560	3160	cmd.exe	107
PID 2380 wrote to memory of 3992	2380	java.exe	108
PID 3992 wrote to memory of 4960	3992	cmd.exe	110
PID 2380 wrote to memory of 1516	2380	java.exe	112
PID 1516 wrote to memory of 1396	1516	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\TEKLIF-ISTEME-FORMU.pdf.jar
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4588
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:4960
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:1396

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
1⤵
PID:1972

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e92de595b527f0953722391336585e0bc164391321834f95b1a3b00a63eccb92
MD5 8be3603384199363ac7b99eb2ac469d3
SHA1 5db4a1d9d8fbc096385ec3647c87bce08a2350ff
SHA512 248d64e251f9054ce05e8e814c912a4323ec96af61ce8e380813c8d8a947d9e71eccc56158b5cc885bdcc40810c6b841ae2b488d180c6a29c17745bae32d65c4
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 377854ee4ef6cda123d09c7fb157e0563fd20bd18aa8f10ef4aa586ef6a24a06
MD5 7f63b75d43b930dd5d2589516f711d85
SHA1 417497c15c02b0b14d0287838ca89136f1245e08
SHA512 78e6ab71acdc4afa89973be019a336211b085e2382b57c3ee255e85db295e2be0ce9dc89166ef72ecf1b696f2c2b6a12b0d9ee305056197e43196a9c62af69b3
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 03fd2e825050f271b9a298a9f988d3d4de16c7113dbe1586aef7ae786bd4c8c2
MD5 b1f25fe0b91ac51c4cd623a81ae0bc60
SHA1 089dfa634b412e3d750304feb5c30ee653dc1f95
SHA512 7121f7464bc03065a7cb018d21465a6bf701e198ad91233f8536e4cc5956df6ad397a5924e2503b5f632dfdc6e4c32d948fa9292071e9ec456ffb68923b71176
MD5 SHA1 SHA512

Submit Download

TEKLIF-ISTEME-FORMU.pdf.jar

Path C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar
Size 97KB
SHA256 fcadd90eca392474bf5d976638e2e63dda47e44cea9fe312e58828c98b614852
MD5 16e9287bc6462685cb4aa2fd54c60d9d
SHA1 0b3163a6e010ce4a19c30ad890fe4b6f3629cb81
SHA512 b9aec05726195120da52b93f8ba70ba8a87ea0427f722a4e8e72445936334b5ae4545ce264bde186ef990972c7f2f79bb84cc9db91faa919156318dcf24eeb23
SSDEEP 1536:OOAoqshl7hoN0ZXots74RrXRdnntQCqqr0aqR1JLXHU2r5yYxIs:OMq8o6xiygrX7nnqUbq5bHUGwYxIs
TLSH
T15AA3F9947B44D072D72360B60A58E21AA9B8E4EFD25571E70FF0ECBDDC29C010F96AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-91-0x000001D56FAD0000-0x000001D56FAD1000-memory.dmp

Download

memory/1896-30-0x00007FF8D18A0000-0x00007FF8D193E000-memory.dmp

Download

memory/1896-2-0x00007FF8D18A0000-0x00007FF8D193E000-memory.dmp

Download

memory/1896-13-0x00007FF8D18A0000-0x00007FF8D193E000-memory.dmp

Download

memory/1896-11-0x000001AF995C0000-0x000001AF995C1000-memory.dmp

Download

memory/1972-65-0x00000187B8EE0000-0x00000187B8EE1000-memory.dmp

Download

memory/2380-34-0x00007FF8D18A0000-0x00007FF8D193E000-memory.dmp

Download

memory/2380-61-0x0000017B28C20000-0x0000017B28C21000-memory.dmp

Download

memory/2380-82-0x0000017B28C20000-0x0000017B28C21000-memory.dmp

Download

memory/2380-104-0x00007FF8D18A0000-0x00007FF8D193E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads