Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 00:55
General
- Target 2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid.exe
- Size 8.4MB
- Sample260808-a91araer2x
- SHA256 f0ef47aca4dc111693a14ff6e3108b1a44603d0a9ea542215f58c951dcbcc70a
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
127.0.0.1:4782
-
a3e8e0b5-df7a-4305-9c19-2ff8f009c8ec
-
encryption_key
B4DA7D0330D95A960126CA441E6C1C292B42C434
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing common artifacts observed in infostealers 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/624-0-0x00007FFD037E0000-0x00007FFD03D85000-memory.dmp
memory/624-1-0x00007FFCEA29F000-0x00007FFCEA2A0000-memory.dmp
memory/624-2-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-3-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-4-0x000001B4E25A0000-0x000001B4E28C4000-memory.dmp
memory/624-5-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-6-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-7-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-8-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-9-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-10-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-11-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-12-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-13-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-14-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-15-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-16-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-17-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-18-0x000001B4E20E0000-0x000001B4E2130000-memory.dmp
memory/624-19-0x000001B4E2270000-0x000001B4E2322000-memory.dmp
memory/624-20-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp
memory/624-21-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp