Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 03:47
General
- Target 2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 4.1MB
- Sample260716-eb7dmacw2p
- SHA256 6484a8063df68014e80d8f7ecde67a3e7ac6f14bac14c4e309ff197328c10093
Malware Config
Extracted
-
quasar
-
encryption_key
F3AB8043B0198333D6A2691546B807A2114451D5
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables manipulated with Fody 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svc_07ea0710.bin"C:\Users\Admin\AppData\Local\Temp\\svc_07ea0710.bin"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
svc_07ea0710.bin
memory/1572-11-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-14-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-6-0x00000201670C0000-0x00000201671B4000-memory.dmp
memory/1572-7-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-8-0x0000020168E50000-0x0000020168E84000-memory.dmp
memory/1572-9-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-10-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-21-0x0000020168FA0000-0x0000020168FDE000-memory.dmp
memory/1572-5-0x00007FFBB062F000-0x00007FFBB0630000-memory.dmp
memory/1572-12-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-13-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-16-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-15-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-17-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-18-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-19-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/1572-20-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp
memory/5704-1-0x000001BF0AB40000-0x000001BF0AB41000-memory.dmp