Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
15/05/2026, 16:58
General
- Target 2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe
- Size 153KB
- Sample260515-vg83eags4p
- SHA256 43c972c6583a4f18778945dd15d948de7de4c4fe2ce5b5989fc2ec572a7b52da
Malware Config
Extracted
-
quasar
-
212.22.82.148:9044;
-
052026
-
https://pastebin.com/raw/3Gsg7PXu
-
3f89b6af-8ae1-442c-9e44-1494590f8e25
-
encryption_key
9DBCAEB4792AAD51B5F52A2E22511DC5770D487C
-
install_name
cache.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
LCache
-
reconnect_delay
2745
-
startup_key
Update Checker
-
subdirectory
DSCache
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 2 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
- Custom signatureDetects executables containing common artifacts observed in infostealers 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\mtkadk.exe"C:\Users\Admin\AppData\Local\mtkadk.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update Checker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\DSCache\cache.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\DSCache\cache.exe"C:\Users\Admin\AppData\Roaming\DSCache\cache.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update Checker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\DSCache\cache.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Roaming\DSCache\cache.exeC:\Users\Admin\AppData\Roaming\DSCache\cache.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tyuel0nn.vni.ps1
mtkadk.exe
memory/584-54-0x000000001D070000-0x000000001D0AC000-memory.dmp
memory/584-53-0x000000001C800000-0x000000001C812000-memory.dmp
memory/584-50-0x000000001C850000-0x000000001C8A0000-memory.dmp
memory/584-51-0x000000001C960000-0x000000001CA12000-memory.dmp
memory/2348-43-0x0000000000A00000-0x0000000000D24000-memory.dmp
memory/2376-21-0x00000231F3340000-0x00000231F334A000-memory.dmp
memory/2376-24-0x00000231F3380000-0x00000231F3386000-memory.dmp
memory/2376-20-0x00000231F3360000-0x00000231F337C000-memory.dmp
memory/2376-1-0x00000231F0750000-0x00000231F0760000-memory.dmp
memory/2376-22-0x00000231F38D0000-0x00000231F38EA000-memory.dmp
memory/2376-23-0x00000231F3350000-0x00000231F3358000-memory.dmp
memory/2376-25-0x00000231F38B0000-0x00000231F38BA000-memory.dmp
memory/2376-19-0x00000231F3310000-0x00000231F331A000-memory.dmp
memory/2376-26-0x00000231F0750000-0x00000231F0760000-memory.dmp
memory/2376-18-0x00000231F35A0000-0x00000231F3653000-memory.dmp
memory/2376-17-0x00000231F3320000-0x00000231F333C000-memory.dmp
memory/2376-10-0x00007FF486470000-0x00007FF486480000-memory.dmp
memory/2376-9-0x00000231F0750000-0x00000231F0760000-memory.dmp
memory/2376-2-0x00000231F0470000-0x00000231F0492000-memory.dmp
memory/2376-0-0x00000231F0750000-0x00000231F0760000-memory.dmp