strrat | 7d3b49cc41ef9a9b6611e34e56e39066336a14dffc707bada037d0e5c7c407b0

Analysis

max time kernel
298s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SIPARIS-TEKLIF-FORMU.jar
Size 97KB
Sample261016-tyg5kshx3t
SHA256 7d3b49cc41ef9a9b6611e34e56e39066336a14dffc707bada037d0e5c7c407b0
MD5 5a7bb822eefc43c3ba16deddb3f8faca
SHA1 a5a73f5a942ec1a35adc47ba69914c18b0959691
SHA512 11d8e0fcd8988e0a73a93a0315442695816bdfcc956ab0018aac6a9296647b9522f0c77ae31ece1a175e540368a55b41fcb79f39411bd07f3c2850d5337562cf
SSDEEP 1536:aOAoOsalchXN0ZXots75RrXRdnCeQUqqr0aqR1JKXHk2o5y3hoi:aMOsX6xiyfrX7CYqUbq5MHk1w3hoi
TLSH
T161A31A187F48D07BD72370728A1A9239BD74E4EFE25465C78EF1AC9DDCA98000F96B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution strrat persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

strrat

elastsolek1replace.duckdns.org:4787
zekeriyasolek44.duckdns.org:4787

Attributes

license_id
WFC9-W4KB-388F-9KY1-S6JV
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
true
secondary_startup
true
startup
true

Signatures

Family: STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIPARIS-TEKLIF-FORMU.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\SIPARIS-TEKLIF-FORMU = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\SIPARIS-TEKLIF-FORMU.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIPARIS-TEKLIF-FORMU = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\SIPARIS-TEKLIF-FORMU.jar\""	java.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5988	cmd.exe
5852	cmd.exe
4392	cmd.exe
2776	cmd.exe
5216	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5880	WMIC.exe
5880	WMIC.exe
5880	WMIC.exe
5880	WMIC.exe
1608	WMIC.exe
1608	WMIC.exe
1608	WMIC.exe
1608	WMIC.exe
3132	WMIC.exe
3132	WMIC.exe
3132	WMIC.exe
3132	WMIC.exe
4116	WMIC.exe
4116	WMIC.exe
4116	WMIC.exe
4116	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5880	WMIC.exe
Token: SeSecurityPrivilege	5880	WMIC.exe
Token: SeTakeOwnershipPrivilege	5880	WMIC.exe
Token: SeLoadDriverPrivilege	5880	WMIC.exe
Token: SeSystemProfilePrivilege	5880	WMIC.exe
Token: SeSystemtimePrivilege	5880	WMIC.exe
Token: SeProfSingleProcessPrivilege	5880	WMIC.exe
Token: SeIncBasePriorityPrivilege	5880	WMIC.exe
Token: SeCreatePagefilePrivilege	5880	WMIC.exe
Token: SeBackupPrivilege	5880	WMIC.exe
Token: SeRestorePrivilege	5880	WMIC.exe
Token: SeShutdownPrivilege	5880	WMIC.exe
Token: SeDebugPrivilege	5880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5880	WMIC.exe
Token: SeRemoteShutdownPrivilege	5880	WMIC.exe
Token: SeUndockPrivilege	5880	WMIC.exe
Token: SeManageVolumePrivilege	5880	WMIC.exe
Token: 33	5880	WMIC.exe
Token: 34	5880	WMIC.exe
Token: 35	5880	WMIC.exe
Token: 36	5880	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5880	WMIC.exe
Token: SeSecurityPrivilege	5880	WMIC.exe
Token: SeTakeOwnershipPrivilege	5880	WMIC.exe
Token: SeLoadDriverPrivilege	5880	WMIC.exe
Token: SeSystemProfilePrivilege	5880	WMIC.exe
Token: SeSystemtimePrivilege	5880	WMIC.exe
Token: SeProfSingleProcessPrivilege	5880	WMIC.exe
Token: SeIncBasePriorityPrivilege	5880	WMIC.exe
Token: SeCreatePagefilePrivilege	5880	WMIC.exe
Token: SeBackupPrivilege	5880	WMIC.exe
Token: SeRestorePrivilege	5880	WMIC.exe
Token: SeShutdownPrivilege	5880	WMIC.exe
Token: SeDebugPrivilege	5880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5880	WMIC.exe
Token: SeRemoteShutdownPrivilege	5880	WMIC.exe
Token: SeUndockPrivilege	5880	WMIC.exe
Token: SeManageVolumePrivilege	5880	WMIC.exe
Token: 33	5880	WMIC.exe
Token: 34	5880	WMIC.exe
Token: 35	5880	WMIC.exe
Token: 36	5880	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1608	WMIC.exe
Token: SeSecurityPrivilege	1608	WMIC.exe
Token: SeTakeOwnershipPrivilege	1608	WMIC.exe
Token: SeLoadDriverPrivilege	1608	WMIC.exe
Token: SeSystemProfilePrivilege	1608	WMIC.exe
Token: SeSystemtimePrivilege	1608	WMIC.exe
Token: SeProfSingleProcessPrivilege	1608	WMIC.exe
Token: SeIncBasePriorityPrivilege	1608	WMIC.exe
Token: SeCreatePagefilePrivilege	1608	WMIC.exe
Token: SeBackupPrivilege	1608	WMIC.exe
Token: SeRestorePrivilege	1608	WMIC.exe
Token: SeShutdownPrivilege	1608	WMIC.exe
Token: SeDebugPrivilege	1608	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1608	WMIC.exe
Token: SeRemoteShutdownPrivilege	1608	WMIC.exe
Token: SeUndockPrivilege	1608	WMIC.exe
Token: SeManageVolumePrivilege	1608	WMIC.exe
Token: 33	1608	WMIC.exe
Token: 34	1608	WMIC.exe
Token: 35	1608	WMIC.exe
Token: 36	1608	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1608	WMIC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 5988	3472	java.exe	90
PID 3472 wrote to memory of 5460	3472	java.exe	91
PID 5988 wrote to memory of 4956	5988	cmd.exe	94
PID 5460 wrote to memory of 5852	5460	java.exe	99
PID 5852 wrote to memory of 5880	5852	cmd.exe	101
PID 5460 wrote to memory of 4392	5460	java.exe	103
PID 4392 wrote to memory of 1608	4392	cmd.exe	105
PID 5460 wrote to memory of 2776	5460	java.exe	106
PID 2776 wrote to memory of 3132	2776	cmd.exe	108
PID 5460 wrote to memory of 5216	5460	java.exe	109
PID 5216 wrote to memory of 4116	5216	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\SIPARIS-TEKLIF-FORMU.jar
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SIPARIS-TEKLIF-FORMU.jar"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SIPARIS-TEKLIF-FORMU.jar"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4956
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\SIPARIS-TEKLIF-FORMU.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5880
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1608
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4116

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\SIPARIS-TEKLIF-FORMU.jar"
1⤵
PID:4484

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\SIPARIS-TEKLIF-FORMU.jar"
1⤵
PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e86c11e36a2b407cef8a5e3ef40d0a7fc5cbf6dacb5150e0429b0e635d3a065d
MD5 1e5bf3dfd9bea34b03daf1cdbae2334d
SHA1 234e1cb311cd1e9c14d0c9976259b097d92c961a
SHA512 a6f764913f5baa77663bba2388ed6a0950b657908b994f21fc7ff2ea5e8790506fa8ca27c19dce1c54f932c7f7abaa53886fef6b449276eb486c13447be2b7b9
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 3d412da465e9a193e98427baa90e158723c264388f650da3d78bbed37bd5b400
MD5 1a19c81fab2e8298a2a510b88821cc06
SHA1 f73d95ee53560d7fd9a45391e8cc729396f48aee
SHA512 97ac079f6ff7db4192beab0a8ff45e1ec42c03290e2e2cd802ecbcd8fef3cc83355977177eb31bf1d29ac7f6b6ffd431efc03cc1edf90627cb78185e3a30afc0
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b5a3a63cb90de781b29f30596b7038ae8b3deb774be049a3060133d80311ec11
MD5 b0e576e67ecbbe25b57d6631c68a6f38
SHA1 ab40486069ade2fbc34631ade867bb95956d8f8f
SHA512 bbf22749de9febcb6b3955de6d65697229d0c14260c9ec843a3d3b07447d7521c6be68304af2442d6e2ea2028d2e44816c5054f14a5f60977ea1e4ecf90c7a81
MD5 SHA1 SHA512

Submit Download

SIPARIS-TEKLIF-FORMU.jar

Path C:\Users\Admin\AppData\Roaming\SIPARIS-TEKLIF-FORMU.jar
Size 97KB
SHA256 7d3b49cc41ef9a9b6611e34e56e39066336a14dffc707bada037d0e5c7c407b0
MD5 5a7bb822eefc43c3ba16deddb3f8faca
SHA1 a5a73f5a942ec1a35adc47ba69914c18b0959691
SHA512 11d8e0fcd8988e0a73a93a0315442695816bdfcc956ab0018aac6a9296647b9522f0c77ae31ece1a175e540368a55b41fcb79f39411bd07f3c2850d5337562cf
SSDEEP 1536:aOAoOsalchXN0ZXots75RrXRdnCeQUqqr0aqR1JKXHk2o5y3hoi:aMOsX6xiyfrX7CYqUbq5MHk1w3hoi
TLSH
T161A31A187F48D07BD72370728A1A9239BD74E4EFE25465C78EF1AC9DDCA98000F96B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3472-23-0x000001A3D9C40000-0x000001A3D9C50000-memory.dmp

Download

memory/3472-39-0x000001A3D9C10000-0x000001A3D9C20000-memory.dmp

Download

memory/3472-21-0x000001A3D9C30000-0x000001A3D9C40000-memory.dmp

Download

memory/3472-2-0x000001A3D9980000-0x000001A3D9BF0000-memory.dmp

Download

memory/3472-26-0x000001A3D9C50000-0x000001A3D9C60000-memory.dmp

Download

memory/3472-17-0x000001A3D9C10000-0x000001A3D9C20000-memory.dmp

Download

memory/3472-34-0x000001A3D9C60000-0x000001A3D9C70000-memory.dmp

Download

memory/3472-36-0x000001A3D9980000-0x000001A3D9BF0000-memory.dmp

Download

memory/3472-44-0x000001A3D9C60000-0x000001A3D9C70000-memory.dmp

Download

memory/3472-42-0x000001A3D9C40000-0x000001A3D9C50000-memory.dmp

Download

memory/3472-41-0x000001A3D9C30000-0x000001A3D9C40000-memory.dmp

Download

memory/3472-19-0x000001A3D9C20000-0x000001A3D9C30000-memory.dmp

Download

memory/3472-37-0x000001A3D9BF0000-0x000001A3D9C00000-memory.dmp

Download

memory/3472-43-0x000001A3D9C50000-0x000001A3D9C60000-memory.dmp

Download

memory/3472-40-0x000001A3D9C20000-0x000001A3D9C30000-memory.dmp

Download

memory/3472-38-0x000001A3D9C00000-0x000001A3D9C10000-memory.dmp

Download

memory/3472-11-0x000001A3D7FC0000-0x000001A3D7FC1000-memory.dmp

Download

memory/3472-15-0x000001A3D9C00000-0x000001A3D9C10000-memory.dmp

Download

memory/3472-13-0x000001A3D9BF0000-0x000001A3D9C00000-memory.dmp

Download

memory/4484-74-0x00000219FAA80000-0x00000219FAA81000-memory.dmp

Download

memory/5460-69-0x0000024086B10000-0x0000024086B11000-memory.dmp

Download

memory/5460-48-0x00000240883E0000-0x0000024088650000-memory.dmp

Download

memory/5460-118-0x00000240883E0000-0x0000024088650000-memory.dmp

Download

memory/5964-97-0x00000209824B0000-0x00000209824B1000-memory.dmp

Download