Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 00:55
General
- Target 2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid.exe
- Size 8.4MB
- Sample260808-a91araer2x
- SHA256 f0ef47aca4dc111693a14ff6e3108b1a44603d0a9ea542215f58c951dcbcc70a
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
127.0.0.1:4782
-
a3e8e0b5-df7a-4305-9c19-2ff8f009c8ec
-
encryption_key
B4DA7D0330D95A960126CA441E6C1C292B42C434
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing common artifacts observed in infostealers 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/880-0-0x00007FFCEF940000-0x00007FFCF0036000-memory.dmp
memory/880-1-0x000002CB5CE90000-0x000002CB5CEA0000-memory.dmp
memory/880-2-0x000002CB5D1D0000-0x000002CB5D4F4000-memory.dmp
memory/880-3-0x000002CB5CE90000-0x000002CB5CEA0000-memory.dmp
memory/880-4-0x000002CB5CE20000-0x000002CB5CE70000-memory.dmp
memory/880-5-0x000002CB5DF70000-0x000002CB5E022000-memory.dmp
memory/880-6-0x000002CB5CE90000-0x000002CB5CEA0000-memory.dmp
memory/880-7-0x000002CB5CE90000-0x000002CB5CEA0000-memory.dmp
memory/880-8-0x000002CB5CE90000-0x000002CB5CEA0000-memory.dmp