Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 11:33
General
- Target 2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 12.2MB
- Sample260421-nn71csdx2j
- SHA256 de13c07883a63867cf43b28b40e65ae95bdf3f0127c9c1c19c0e27d60d6fff2b
Malware Config
Extracted
-
quasar
-
encryption_key
598B154EC173012C4F84BCE7164F2DF0F12F2020
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 2 IoCs
- Custom signatureDetects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Custom signatureDetects executables manipulated with Fody 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 20 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\runtimemonitorbdln.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\runtimemonitorbdln.exe5⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\del.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 36⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
runtimemonitorbdln.exe
RuntimeBroker.exe
_rust.pyd
VCRUNTIME140.dll
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python314.dll
select.pyd
unicodedata.pyd
del.bat
memory/5252-133-0x0000021F5FF40000-0x0000021F5FF52000-memory.dmp
memory/5252-138-0x0000021F60AF0000-0x0000021F60B52000-memory.dmp
memory/5252-131-0x0000021F47760000-0x0000021F47790000-memory.dmp
memory/5252-134-0x0000021F60A90000-0x0000021F60ACC000-memory.dmp
memory/5252-135-0x0000021F60A50000-0x0000021F60A5A000-memory.dmp
memory/5252-136-0x0000021F60A60000-0x0000021F60A86000-memory.dmp
memory/5252-137-0x0000021F60AE0000-0x0000021F60AE8000-memory.dmp
memory/5252-132-0x0000021F60070000-0x0000021F600A8000-memory.dmp
memory/5252-139-0x0000021F60B60000-0x0000021F60BA2000-memory.dmp
memory/5252-140-0x0000021F600B0000-0x0000021F600BA000-memory.dmp
memory/5252-141-0x0000021F60AD0000-0x0000021F60ADA000-memory.dmp
memory/5252-142-0x0000021F60BC0000-0x0000021F60BDA000-memory.dmp
memory/5252-143-0x0000021F60E30000-0x0000021F60E52000-memory.dmp
memory/5252-145-0x0000021F45E00000-0x0000021F45E0C000-memory.dmp
memory/5252-144-0x0000021F600D0000-0x0000021F6080F000-memory.dmp
memory/5252-130-0x0000021F458D0000-0x0000021F45A56000-memory.dmp