Analysis
- max time kernel
5s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 14:12
General
- Target 2026-07-12_1890c62e990812858c8805c73e45bf25_icedid_luca-stealer_njrat_ryuk_stealc.exe
- Size 1.5MB
- Sample260712-rhtsbsbt5m
- SHA256 5ab2763a9f74627d5d9cde3a85925d25f2984993de350a97e8fda63a721896f4
Malware Config
Extracted
-
quasar
-
encryption_key
F489B5BBD06746617AD115081D0E2B1E892A2D72
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Detects Windows executables referencing non-Windows User-Agents 3 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Modifies registry class 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_1890c62e990812858c8805c73e45bf25_icedid_luca-stealer_njrat_ryuk_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_1890c62e990812858c8805c73e45bf25_icedid_luca-stealer_njrat_ryuk_stealc.exe"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsDefender\WidgetService.exeC:\Users\Admin\AppData\Roaming\Microsoft\WindowsDefender\WidgetService.exe1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WidgetService.exe
memory/1940-31-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/1940-30-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/1940-29-0x000002232AC30000-0x000002232ACB2000-memory.dmp
memory/1940-27-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/1940-26-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/1940-25-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-10-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-22-0x0000026DA9F20000-0x0000026DA9FD2000-memory.dmp
memory/5048-11-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-12-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-14-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-13-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-15-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-17-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-18-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-16-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-19-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-20-0x0000026DA9E10000-0x0000026DA9E60000-memory.dmp
memory/5048-8-0x0000026D903A0000-0x0000026D903A8000-memory.dmp
memory/5048-2-0x0000026D90100000-0x0000026D90101000-memory.dmp
memory/5048-9-0x0000026D904F0000-0x0000026D90572000-memory.dmp
memory/5048-7-0x0000026D90390000-0x0000026D90398000-memory.dmp
memory/5048-5-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-4-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-3-0x00007FFDBCE5F000-0x00007FFDBCE60000-memory.dmp
memory/5048-0-0x0000026D901A0000-0x0000026D9021D000-memory.dmp
memory/5048-33-0x0000026DA9EA0000-0x0000026DA9EDC000-memory.dmp
memory/5048-32-0x0000026DA9DE0000-0x0000026DA9DF2000-memory.dmp
memory/5048-34-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-35-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/5048-36-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp