Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/07/2026, 03:47
General
- Target 2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 4.1MB
- Sample260716-eb7dmacw2p
- SHA256 6484a8063df68014e80d8f7ecde67a3e7ac6f14bac14c4e309ff197328c10093
Score
10/10
Malware Config
Extracted
Family
-
quasar
Attributes
-
encryption_key
F3AB8043B0198333D6A2691546B807A2114451D5
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables manipulated with Fody 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svc_07ea0710.bin"C:\Users\Admin\AppData\Local\Temp\\svc_07ea0710.bin"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
svc_07ea0710.bin
memory/2104-5-0x0000021170420000-0x0000021170514000-memory.dmp
memory/2104-6-0x0000021170930000-0x0000021170940000-memory.dmp
memory/2104-7-0x00000211708F0000-0x0000021170924000-memory.dmp
memory/2104-8-0x0000021170930000-0x0000021170940000-memory.dmp
memory/2104-9-0x00000211737F0000-0x0000021173828000-memory.dmp
memory/4488-1-0x0000017A71FF0000-0x0000017A71FF1000-memory.dmp