Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 11:33
General
- Target 2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 12.2MB
- Sample260421-nn71csdx2j
- SHA256 de13c07883a63867cf43b28b40e65ae95bdf3f0127c9c1c19c0e27d60d6fff2b
Malware Config
Extracted
-
quasar
-
encryption_key
598B154EC173012C4F84BCE7164F2DF0F12F2020
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 2 IoCs
- Custom signatureDetects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Custom signatureDetects executables manipulated with Fody 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 20 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_c3c3fdf13ef0d6e1bc5e367d72269e4d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\winhandlerrj5f.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\winhandlerrj5f.exe5⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\del.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 36⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
winhandlerrj5f.exe
RuntimeBroker.exe
VCRUNTIME140.dll
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.dll
python314.dll
select.pyd
unicodedata.pyd
_rust.pyd
del.bat
memory/764-151-0x000002BB6A550000-0x000002BB6A6EA000-memory.dmp
memory/764-128-0x000002BB6A550000-0x000002BB6A6EA000-memory.dmp
memory/1576-141-0x000001D26DEA0000-0x000001D26DF02000-memory.dmp
memory/1576-143-0x000001D26DDF0000-0x000001D26DDFA000-memory.dmp
memory/1576-135-0x000001D26DDD0000-0x000001D26DDE2000-memory.dmp
memory/1576-136-0x000001D26DE30000-0x000001D26DE6C000-memory.dmp
memory/1576-138-0x000001D26DE00000-0x000001D26DE0A000-memory.dmp
memory/1576-139-0x000001D26DE70000-0x000001D26DE96000-memory.dmp
memory/1576-140-0x000001D26DE20000-0x000001D26DE28000-memory.dmp
memory/1576-132-0x000001D253160000-0x000001D2532E6000-memory.dmp
memory/1576-142-0x000001D26DF10000-0x000001D26DF52000-memory.dmp
memory/1576-134-0x000001D26DD90000-0x000001D26DDC8000-memory.dmp
memory/1576-144-0x000001D26DE10000-0x000001D26DE1A000-memory.dmp
memory/1576-145-0x000001D26DF70000-0x000001D26DF8A000-memory.dmp
memory/1576-146-0x000001D26E1E0000-0x000001D26E202000-memory.dmp
memory/1576-149-0x000001D26DAD0000-0x000001D26DAE2000-memory.dmp
memory/1576-148-0x000001D253840000-0x000001D25384C000-memory.dmp
memory/1576-147-0x000001D26D700000-0x000001D26D89A000-memory.dmp
memory/1576-133-0x000001D26D910000-0x000001D26D940000-memory.dmp
memory/1832-67-0x000001F5EC430000-0x000001F5EC5CA000-memory.dmp