Analysis
- max time kernel
150s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 17:23
General
- Target 2026-08-15_f67590dcd25e926e4e8f84da2950d5c8_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 26.5MB
- Sample260815-vx83caem2w
- SHA256 af0c5eebfe2dcffc7039c1bae13277a2a93693180cfa714dd0ec4ed75f9172fb
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
WORK
-
31.220.89.57:19999
-
QSR_MUTEX_CTqPyFQvGnWcNbG1fM
-
encryption_key
rygaJCKyghXzysqn4nXc
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
APP
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Detects Windows executables referencing non-Windows User-Agents 3 IoCs
- Detects executables containing common artifacts observed in infostealers 3 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_f67590dcd25e926e4e8f84da2950d5c8_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f67590dcd25e926e4e8f84da2950d5c8_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\crypted.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\crypted.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
- Porn Video - Home Alone With Stepbro And FreeUsed - Apply code FREEUSE26 on official site.mp4
crypted.exe
wmsetup.log
memory/2724-63-0x0000000005820000-0x0000000005886000-memory.dmp
memory/2724-67-0x00000000076E0000-0x000000000771C000-memory.dmp
memory/2724-66-0x00000000070B0000-0x00000000070BA000-memory.dmp
memory/2724-64-0x0000000006670000-0x0000000006682000-memory.dmp
memory/2724-54-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2724-55-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2724-56-0x0000000000400000-0x000000000045E000-memory.dmp
memory/2724-57-0x0000000005BF0000-0x00000000061AA000-memory.dmp
memory/2724-58-0x0000000005780000-0x0000000005812000-memory.dmp
memory/3660-44-0x0000000007B80000-0x0000000007B90000-memory.dmp
memory/3660-59-0x0000000007B80000-0x0000000007B90000-memory.dmp
memory/3660-62-0x0000000007B80000-0x0000000007B90000-memory.dmp
memory/3660-61-0x0000000007B80000-0x0000000007B90000-memory.dmp
memory/3660-60-0x0000000007B80000-0x0000000007B90000-memory.dmp
memory/3660-42-0x0000000007B80000-0x0000000007B90000-memory.dmp
memory/3660-43-0x0000000007B80000-0x0000000007B90000-memory.dmp
memory/3660-45-0x0000000007B80000-0x0000000007B90000-memory.dmp