Analysis
- max time kernel
10s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 08:18
General
- Target 2026-07-15_2ca46a2cfca02c4e21c245c4ad6cf914_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 4.1MB
- Sample260715-j7eqpsay4t
- SHA256 4ec263820148800dd59be6fdcdd5013014268eb548f547b91f298481a23898c3
Malware Config
Extracted
-
quasar
-
encryption_key
F3AB8043B0198333D6A2691546B807A2114451D5
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables manipulated with Fody 2 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_2ca46a2cfca02c4e21c245c4ad6cf914_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_2ca46a2cfca02c4e21c245c4ad6cf914_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_2ca46a2cfca02c4e21c245c4ad6cf914_cobalt-strike_icedid_njrat_satacom_stealc.exeC:\Users\Admin\AppData\Local\Temp\2026-07-15_2ca46a2cfca02c4e21c245c4ad6cf914_cobalt-strike_icedid_njrat_satacom_stealc.exe1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\csrv_update.bin"C:\Users\Admin\AppData\Local\Temp\\csrv_update.bin"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
csrv_update.bin
memory/3776-4-0x00007FFF1D4FF000-0x00007FFF1D500000-memory.dmp
memory/3776-5-0x0000017DA1C20000-0x0000017DA1D14000-memory.dmp
memory/3776-6-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-7-0x0000017DA2200000-0x0000017DA2234000-memory.dmp
memory/3776-8-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-9-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-10-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-11-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-12-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-13-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-14-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-15-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp
memory/3776-16-0x0000017DBC580000-0x0000017DBC5BE000-memory.dmp