strrat | fcadd90eca392474bf5d976638e2e63dda47e44cea9fe312e58828c98b614852

Analysis

max time kernel
299s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TEKLIF-ISTEME-FORMU.pdf.jar
Size 97KB
Sample261014-vg2ckaha83
SHA256 fcadd90eca392474bf5d976638e2e63dda47e44cea9fe312e58828c98b614852
MD5 16e9287bc6462685cb4aa2fd54c60d9d
SHA1 0b3163a6e010ce4a19c30ad890fe4b6f3629cb81
SHA512 b9aec05726195120da52b93f8ba70ba8a87ea0427f722a4e8e72445936334b5ae4545ce264bde186ef990972c7f2f79bb84cc9db91faa919156318dcf24eeb23
SSDEEP 1536:OOAoqshl7hoN0ZXots74RrXRdnntQCqqr0aqR1JLXHU2r5yYxIs:OMq8o6xiygrX7nnqUbq5bHUGwYxIs
TLSH
T15AA3F9947B44D072D72360B60A58E21AA9B8E4EFD25571E70FF0ECBDDC29C010F96AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution strrat persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

strrat

elastsolek1replace.duckdns.org:4787
zekeriyasolek44.duckdns.org:4787

Attributes

license_id
WFC9-W4KB-388F-9KY1-S6JV
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
true
secondary_startup
true
startup
true

Signatures

Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TEKLIF-ISTEME-FORMU.pdf.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\TEKLIF-ISTEME-FORMU.pdf = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\TEKLIF-ISTEME-FORMU.pdf.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TEKLIF-ISTEME-FORMU.pdf = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\TEKLIF-ISTEME-FORMU.pdf.jar\""	java.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1340	cmd.exe
2280	cmd.exe
4360	cmd.exe
4580	cmd.exe
6092	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5920	WMIC.exe
5920	WMIC.exe
5920	WMIC.exe
5920	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
2188	WMIC.exe
2188	WMIC.exe
2188	WMIC.exe
2188	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5920	WMIC.exe
Token: SeSecurityPrivilege	5920	WMIC.exe
Token: SeTakeOwnershipPrivilege	5920	WMIC.exe
Token: SeLoadDriverPrivilege	5920	WMIC.exe
Token: SeSystemProfilePrivilege	5920	WMIC.exe
Token: SeSystemtimePrivilege	5920	WMIC.exe
Token: SeProfSingleProcessPrivilege	5920	WMIC.exe
Token: SeIncBasePriorityPrivilege	5920	WMIC.exe
Token: SeCreatePagefilePrivilege	5920	WMIC.exe
Token: SeBackupPrivilege	5920	WMIC.exe
Token: SeRestorePrivilege	5920	WMIC.exe
Token: SeShutdownPrivilege	5920	WMIC.exe
Token: SeDebugPrivilege	5920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5920	WMIC.exe
Token: SeRemoteShutdownPrivilege	5920	WMIC.exe
Token: SeUndockPrivilege	5920	WMIC.exe
Token: SeManageVolumePrivilege	5920	WMIC.exe
Token: 33	5920	WMIC.exe
Token: 34	5920	WMIC.exe
Token: 35	5920	WMIC.exe
Token: 36	5920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5920	WMIC.exe
Token: SeSecurityPrivilege	5920	WMIC.exe
Token: SeTakeOwnershipPrivilege	5920	WMIC.exe
Token: SeLoadDriverPrivilege	5920	WMIC.exe
Token: SeSystemProfilePrivilege	5920	WMIC.exe
Token: SeSystemtimePrivilege	5920	WMIC.exe
Token: SeProfSingleProcessPrivilege	5920	WMIC.exe
Token: SeIncBasePriorityPrivilege	5920	WMIC.exe
Token: SeCreatePagefilePrivilege	5920	WMIC.exe
Token: SeBackupPrivilege	5920	WMIC.exe
Token: SeRestorePrivilege	5920	WMIC.exe
Token: SeShutdownPrivilege	5920	WMIC.exe
Token: SeDebugPrivilege	5920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5920	WMIC.exe
Token: SeRemoteShutdownPrivilege	5920	WMIC.exe
Token: SeUndockPrivilege	5920	WMIC.exe
Token: SeManageVolumePrivilege	5920	WMIC.exe
Token: 33	5920	WMIC.exe
Token: 34	5920	WMIC.exe
Token: 35	5920	WMIC.exe
Token: 36	5920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4920	WMIC.exe
Token: SeSecurityPrivilege	4920	WMIC.exe
Token: SeTakeOwnershipPrivilege	4920	WMIC.exe
Token: SeLoadDriverPrivilege	4920	WMIC.exe
Token: SeSystemProfilePrivilege	4920	WMIC.exe
Token: SeSystemtimePrivilege	4920	WMIC.exe
Token: SeProfSingleProcessPrivilege	4920	WMIC.exe
Token: SeIncBasePriorityPrivilege	4920	WMIC.exe
Token: SeCreatePagefilePrivilege	4920	WMIC.exe
Token: SeBackupPrivilege	4920	WMIC.exe
Token: SeRestorePrivilege	4920	WMIC.exe
Token: SeShutdownPrivilege	4920	WMIC.exe
Token: SeDebugPrivilege	4920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4920	WMIC.exe
Token: SeRemoteShutdownPrivilege	4920	WMIC.exe
Token: SeUndockPrivilege	4920	WMIC.exe
Token: SeManageVolumePrivilege	4920	WMIC.exe
Token: 33	4920	WMIC.exe
Token: 34	4920	WMIC.exe
Token: 35	4920	WMIC.exe
Token: 36	4920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4920	WMIC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 124 wrote to memory of 2280	124	java.exe	92
PID 2280 wrote to memory of 1164	2280	cmd.exe	95
PID 124 wrote to memory of 5268	124	java.exe	94
PID 5268 wrote to memory of 4360	5268	java.exe	101
PID 4360 wrote to memory of 5920	4360	cmd.exe	103
PID 5268 wrote to memory of 4580	5268	java.exe	104
PID 4580 wrote to memory of 4920	4580	cmd.exe	106
PID 5268 wrote to memory of 6092	5268	java.exe	107
PID 6092 wrote to memory of 2188	6092	cmd.exe	109
PID 5268 wrote to memory of 1340	5268	java.exe	110
PID 1340 wrote to memory of 3268	1340	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\TEKLIF-ISTEME-FORMU.pdf.jar
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:124
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1164
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4920
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2188
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3268

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
1⤵
PID:6032

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar"
1⤵
PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 2467daca43785ae687d8e5a0f54dc8b3fd58a33395475719863aa4c3f05dd3a0
MD5 98c5d4e78fa92c23e2b1f5b231d107fe
SHA1 f91348413c07e927d7de636a5d1b68878b42e879
SHA512 a9b220953c244518f348d10f9c237c8eb61c05b2495cb9dacfe60ce058c349d2f66352f87992f102cb793f13aa2288ea0a8350366bce8226bae19d26d6c8f32c
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 dadb3395c641d6b5f423e2c8fae2d53c39e7e44d6dfc0c036b5a4a5c4cd92e70
MD5 cbc494723daeab07c64286752009810b
SHA1 30c26a7b58059df6bc7e519023da0fbc07647b39
SHA512 97c766e5932615f39c5cb81fb54c0011c51d0f33140ad04f2213be1477d95ac66f8e203891e3de70afbb6757971859f5ec915046aa92914560c1eab21ee0fc48
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 477126810dfe3e96858a2be84b5424195db26f5aff51cb18262a9bc549af2e82
MD5 f97cf219f77a745ec45b4f67753561fa
SHA1 cadc346559f48021924cd80dbf6bcc754a64c271
SHA512 32224e28a67acf48a16db9c6ee2e7000c3c913d00d5f54ef88cc53deec2a411ec81f524f6f0172bee224b6f2d925d18d5bbf8c35e5c8fc129db8effc5eae0bcc
MD5 SHA1 SHA512

Submit Download

TEKLIF-ISTEME-FORMU.pdf.jar

Path C:\Users\Admin\AppData\Roaming\TEKLIF-ISTEME-FORMU.pdf.jar
Size 97KB
SHA256 fcadd90eca392474bf5d976638e2e63dda47e44cea9fe312e58828c98b614852
MD5 16e9287bc6462685cb4aa2fd54c60d9d
SHA1 0b3163a6e010ce4a19c30ad890fe4b6f3629cb81
SHA512 b9aec05726195120da52b93f8ba70ba8a87ea0427f722a4e8e72445936334b5ae4545ce264bde186ef990972c7f2f79bb84cc9db91faa919156318dcf24eeb23
SSDEEP 1536:OOAoqshl7hoN0ZXots74RrXRdnntQCqqr0aqR1JLXHU2r5yYxIs:OMq8o6xiygrX7nnqUbq5bHUGwYxIs
TLSH
T15AA3F9947B44D072D72360B60A58E21AA9B8E4EFD25571E70FF0ECBDDC29C010F96AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-47-0x000001A115F10000-0x000001A115F20000-memory.dmp

Download

memory/124-45-0x000001A115EF0000-0x000001A115F00000-memory.dmp

Download

memory/124-23-0x000001A115EF0000-0x000001A115F00000-memory.dmp

Download

memory/124-22-0x000001A115EE0000-0x000001A115EF0000-memory.dmp

Download

memory/124-27-0x000001A115F00000-0x000001A115F10000-memory.dmp

Download

memory/124-28-0x000001A115F10000-0x000001A115F20000-memory.dmp

Download

memory/124-25-0x000001A115BF0000-0x000001A115BF1000-memory.dmp

Download

memory/124-31-0x000001A115F20000-0x000001A115F30000-memory.dmp

Download

memory/124-30-0x000001A115C30000-0x000001A115EA0000-memory.dmp

Download

memory/124-17-0x000001A115EC0000-0x000001A115ED0000-memory.dmp

Download

memory/124-39-0x000001A115C30000-0x000001A115EA0000-memory.dmp

Download

memory/124-48-0x000001A115F20000-0x000001A115F30000-memory.dmp

Download

memory/124-2-0x000001A115C30000-0x000001A115EA0000-memory.dmp

Download

memory/124-46-0x000001A115F00000-0x000001A115F10000-memory.dmp

Download

memory/124-11-0x000001A115BF0000-0x000001A115BF1000-memory.dmp

Download

memory/124-19-0x000001A115ED0000-0x000001A115EE0000-memory.dmp

Download

memory/124-44-0x000001A115EE0000-0x000001A115EF0000-memory.dmp

Download

memory/124-43-0x000001A115ED0000-0x000001A115EE0000-memory.dmp

Download

memory/124-42-0x000001A115EC0000-0x000001A115ED0000-memory.dmp

Download

memory/124-41-0x000001A115EB0000-0x000001A115EC0000-memory.dmp

Download

memory/124-40-0x000001A115EA0000-0x000001A115EB0000-memory.dmp

Download

memory/124-15-0x000001A115EB0000-0x000001A115EC0000-memory.dmp

Download

memory/124-13-0x000001A115EA0000-0x000001A115EB0000-memory.dmp

Download

memory/5152-93-0x000001EB34E00000-0x000001EB34E01000-memory.dmp

Download

memory/5268-73-0x000002463F500000-0x000002463F501000-memory.dmp

Download

memory/5268-52-0x000002463F550000-0x000002463F7C0000-memory.dmp

Download

memory/5268-88-0x000002463F500000-0x000002463F501000-memory.dmp

Download

memory/5268-121-0x000002463F500000-0x000002463F501000-memory.dmp

Download

memory/5268-128-0x000002463F550000-0x000002463F7C0000-memory.dmp

Download

memory/6032-85-0x0000029DCBE90000-0x0000029DCBE91000-memory.dmp

Download