strrat | f19a66439fccae13f0d310b653e6b60dfc9b6f7d70e163952fb6cd18e0ec096e

Analysis

max time kernel
298s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RICHIESTA-D-OFFERTA.jar
Size 97KB
Sample261016-dc2zvsgv2j
SHA256 f19a66439fccae13f0d310b653e6b60dfc9b6f7d70e163952fb6cd18e0ec096e
MD5 b7a7c8b53ab0b082113226dcbcf51a00
SHA1 7fa74ea03c86cf8f0cc030c880dff48737925648
SHA512 a3f69fb1ba85536f98dd0f50db6a38ecb4d35fbb81314f875bd9be22377a3aa602e67315519bdde8017cc83413e162420ab2341bf3083645a88f48ae5b14c293
SSDEEP 1536:eOAoKsVlfh0N0ZXots70RrXRdnvpQ2qqr0aqR1J7XHQ235y8h7c:eMKE06xiyErX7v3qUbq5rHQGw8h7c
TLSH
T19DA318057B48D072E72370726A18B25AED74E4EFDA5561D70FF0ACDDDC2A8800FA6B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution strrat persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

strrat

elastsolek1replace.duckdns.org:4787
zekeriyasolek44.duckdns.org:4787

Attributes

license_id
WFC9-W4KB-388F-9KY1-S6JV
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
true
secondary_startup
true
startup
true

Signatures

Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RICHIESTA-D-OFFERTA.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\RICHIESTA-D-OFFERTA = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\RICHIESTA-D-OFFERTA.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RICHIESTA-D-OFFERTA = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\RICHIESTA-D-OFFERTA.jar\""	java.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1256	cmd.exe
4676	cmd.exe
3012	cmd.exe
3376	cmd.exe
1796	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2904	WMIC.exe
2904	WMIC.exe
2904	WMIC.exe
2904	WMIC.exe
4300	WMIC.exe
4300	WMIC.exe
4300	WMIC.exe
4300	WMIC.exe
1268	WMIC.exe
1268	WMIC.exe
1268	WMIC.exe
1268	WMIC.exe
3004	WMIC.exe
3004	WMIC.exe
3004	WMIC.exe
3004	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2904	WMIC.exe
Token: SeSecurityPrivilege	2904	WMIC.exe
Token: SeTakeOwnershipPrivilege	2904	WMIC.exe
Token: SeLoadDriverPrivilege	2904	WMIC.exe
Token: SeSystemProfilePrivilege	2904	WMIC.exe
Token: SeSystemtimePrivilege	2904	WMIC.exe
Token: SeProfSingleProcessPrivilege	2904	WMIC.exe
Token: SeIncBasePriorityPrivilege	2904	WMIC.exe
Token: SeCreatePagefilePrivilege	2904	WMIC.exe
Token: SeBackupPrivilege	2904	WMIC.exe
Token: SeRestorePrivilege	2904	WMIC.exe
Token: SeShutdownPrivilege	2904	WMIC.exe
Token: SeDebugPrivilege	2904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2904	WMIC.exe
Token: SeRemoteShutdownPrivilege	2904	WMIC.exe
Token: SeUndockPrivilege	2904	WMIC.exe
Token: SeManageVolumePrivilege	2904	WMIC.exe
Token: 33	2904	WMIC.exe
Token: 34	2904	WMIC.exe
Token: 35	2904	WMIC.exe
Token: 36	2904	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2904	WMIC.exe
Token: SeSecurityPrivilege	2904	WMIC.exe
Token: SeTakeOwnershipPrivilege	2904	WMIC.exe
Token: SeLoadDriverPrivilege	2904	WMIC.exe
Token: SeSystemProfilePrivilege	2904	WMIC.exe
Token: SeSystemtimePrivilege	2904	WMIC.exe
Token: SeProfSingleProcessPrivilege	2904	WMIC.exe
Token: SeIncBasePriorityPrivilege	2904	WMIC.exe
Token: SeCreatePagefilePrivilege	2904	WMIC.exe
Token: SeBackupPrivilege	2904	WMIC.exe
Token: SeRestorePrivilege	2904	WMIC.exe
Token: SeShutdownPrivilege	2904	WMIC.exe
Token: SeDebugPrivilege	2904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2904	WMIC.exe
Token: SeRemoteShutdownPrivilege	2904	WMIC.exe
Token: SeUndockPrivilege	2904	WMIC.exe
Token: SeManageVolumePrivilege	2904	WMIC.exe
Token: 33	2904	WMIC.exe
Token: 34	2904	WMIC.exe
Token: 35	2904	WMIC.exe
Token: 36	2904	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4300	WMIC.exe
Token: SeSecurityPrivilege	4300	WMIC.exe
Token: SeTakeOwnershipPrivilege	4300	WMIC.exe
Token: SeLoadDriverPrivilege	4300	WMIC.exe
Token: SeSystemProfilePrivilege	4300	WMIC.exe
Token: SeSystemtimePrivilege	4300	WMIC.exe
Token: SeProfSingleProcessPrivilege	4300	WMIC.exe
Token: SeIncBasePriorityPrivilege	4300	WMIC.exe
Token: SeCreatePagefilePrivilege	4300	WMIC.exe
Token: SeBackupPrivilege	4300	WMIC.exe
Token: SeRestorePrivilege	4300	WMIC.exe
Token: SeShutdownPrivilege	4300	WMIC.exe
Token: SeDebugPrivilege	4300	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4300	WMIC.exe
Token: SeRemoteShutdownPrivilege	4300	WMIC.exe
Token: SeUndockPrivilege	4300	WMIC.exe
Token: SeManageVolumePrivilege	4300	WMIC.exe
Token: 33	4300	WMIC.exe
Token: 34	4300	WMIC.exe
Token: 35	4300	WMIC.exe
Token: 36	4300	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4300	WMIC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1256	5052	java.exe	90
PID 1256 wrote to memory of 4544	1256	cmd.exe	93
PID 5052 wrote to memory of 2428	5052	java.exe	92
PID 2428 wrote to memory of 4676	2428	java.exe	99
PID 4676 wrote to memory of 2904	4676	cmd.exe	101
PID 2428 wrote to memory of 3012	2428	java.exe	103
PID 3012 wrote to memory of 4300	3012	cmd.exe	105
PID 2428 wrote to memory of 3376	2428	java.exe	106
PID 3376 wrote to memory of 1268	3376	cmd.exe	108
PID 2428 wrote to memory of 1796	2428	java.exe	109
PID 1796 wrote to memory of 3004	1796	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\RICHIESTA-D-OFFERTA.jar
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\RICHIESTA-D-OFFERTA.jar"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\RICHIESTA-D-OFFERTA.jar"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4544
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\RICHIESTA-D-OFFERTA.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1268
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3004

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\RICHIESTA-D-OFFERTA.jar"
1⤵
PID:1028

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\RICHIESTA-D-OFFERTA.jar"
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 bd3d5a22f52c37e9c2d651aed327adc84728de28b1a079fceabc1a21c06091de
MD5 038151297281d8fc994b56473ada8c50
SHA1 d7f992b3c7e98d5a48da4c9203980aa5006c36d1
SHA512 8527b6e2723865e20afc2f84ec48f4e32853a67190dda7e3a144101ece44ef63ab93d442c60ab5f92ef52d7b0a81caff1dcd3dccf16695256585da32aa851563
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 bbe91e69ff8cb582d5390e7b93ebcb3136b97b23edd9facccb3478e3db0368d6
MD5 407c2196d58e0779186cb6094191c0dc
SHA1 865501df4f5be1b7f797c5c4d80b608148f64678
SHA512 0cfca3ecf0ed44882210e0cc9a6c70fa3374243b94ee1c7ef59f1777f18158e76b73dc878bc1c9992f70e745d1898871095d09544940fef2e7ac710cfab20721
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 89368d253604791c441c6cfb4a3bd5142b802647637521d27344041f59310827
MD5 71b7262f1adbd482bbc283e6dd744316
SHA1 2deebefab7c7da685a1db2794fb1c59354748125
SHA512 6dcd8b663f5017071b96f7ea0d7622eaad52af0cf128d9bb33da36dbab47c4c71a155b068e4bd18f06be46547b92cbfd7e18cb9f9f3397808d8e174efaa692a5
MD5 SHA1 SHA512

Submit Download

RICHIESTA-D-OFFERTA.jar

Path C:\Users\Admin\AppData\Roaming\RICHIESTA-D-OFFERTA.jar
Size 97KB
SHA256 f19a66439fccae13f0d310b653e6b60dfc9b6f7d70e163952fb6cd18e0ec096e
MD5 b7a7c8b53ab0b082113226dcbcf51a00
SHA1 7fa74ea03c86cf8f0cc030c880dff48737925648
SHA512 a3f69fb1ba85536f98dd0f50db6a38ecb4d35fbb81314f875bd9be22377a3aa602e67315519bdde8017cc83413e162420ab2341bf3083645a88f48ae5b14c293
SSDEEP 1536:eOAoKsVlfh0N0ZXots70RrXRdnvpQ2qqr0aqR1J7XHQ235y8h7c:eMKE06xiyErX7v3qUbq5rHQGw8h7c
TLSH
T19DA318057B48D072E72370726A18B25AED74E4EFDA5561D70FF0ACDDDC2A8800FA6B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-81-0x00000168E47F0000-0x00000168E47F1000-memory.dmp

Download

memory/1252-91-0x000002073BE20000-0x000002073BE21000-memory.dmp

Download

memory/2428-48-0x000001F9A5840000-0x000001F9A5AB0000-memory.dmp

Download

memory/2428-119-0x000001F9A5840000-0x000001F9A5AB0000-memory.dmp

Download

memory/2428-112-0x000001F9A57B0000-0x000001F9A57B1000-memory.dmp

Download

memory/2428-85-0x000001F9A57B0000-0x000001F9A57B1000-memory.dmp

Download

memory/2428-62-0x000001F9A57B0000-0x000001F9A57B1000-memory.dmp

Download

memory/5052-24-0x000001F4D8F30000-0x000001F4D8F40000-memory.dmp

Download

memory/5052-36-0x000001F4D8C70000-0x000001F4D8EE0000-memory.dmp

Download

memory/5052-44-0x000001F4D8F50000-0x000001F4D8F60000-memory.dmp

Download

memory/5052-43-0x000001F4D8F40000-0x000001F4D8F50000-memory.dmp

Download

memory/5052-42-0x000001F4D8F30000-0x000001F4D8F40000-memory.dmp

Download

memory/5052-41-0x000001F4D8F20000-0x000001F4D8F30000-memory.dmp

Download

memory/5052-39-0x000001F4D8F00000-0x000001F4D8F10000-memory.dmp

Download

memory/5052-38-0x000001F4D8EF0000-0x000001F4D8F00000-memory.dmp

Download

memory/5052-37-0x000001F4D8EE0000-0x000001F4D8EF0000-memory.dmp

Download

memory/5052-40-0x000001F4D8F10000-0x000001F4D8F20000-memory.dmp

Download

memory/5052-27-0x000001F4D8F50000-0x000001F4D8F60000-memory.dmp

Download

memory/5052-25-0x000001F4D8F40000-0x000001F4D8F50000-memory.dmp

Download

memory/5052-2-0x000001F4D8C70000-0x000001F4D8EE0000-memory.dmp

Download

memory/5052-20-0x000001F4D8F10000-0x000001F4D8F20000-memory.dmp

Download

memory/5052-21-0x000001F4D8F20000-0x000001F4D8F30000-memory.dmp

Download

memory/5052-17-0x000001F4D8F00000-0x000001F4D8F10000-memory.dmp

Download

memory/5052-15-0x000001F4D8EF0000-0x000001F4D8F00000-memory.dmp

Download

memory/5052-13-0x000001F4D8EE0000-0x000001F4D8EF0000-memory.dmp

Download

memory/5052-11-0x000001F4D7380000-0x000001F4D7381000-memory.dmp

Download