Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/09/2026, 03:45
General
- Target 2026-09-22_0d15c69bb5677b55db196ba0803314bf_icedid.exe
- Size 2.0MB
- Sample260923-ea9scss17m
- SHA256 9978035dc965301287c08e4d55f345bca2bfda901e5414459e9f234c90680761
Malware Config
Extracted
-
quasar
-
1.6.6
-
Office04
-
bthnqzodwt.a.pinggy.link:16679
-
1dfd38b4-2e4d-42b4-9ed3-a33260992c4a
-
encryption_key
3A3E8AB0D198B43DE9220A615D06D3CF0B933A7B
-
install_name
.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- PulsaRAT library module 1 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_0d15c69bb5677b55db196ba0803314bf_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_0d15c69bb5677b55db196ba0803314bf_icedid.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /target:library /out:C:\Users\Admin\AppData\Local\Temp\_loader.dll C:\Users\Admin\AppData\Local\Temp\_loader.cs2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C9B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC96696768BA754D0694943394E1EBB671.TMP"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES6C9B.tmp
_loader.dll
h3stub.log
CSC96696768BA754D0694943394E1EBB671.TMP
_loader.cs
memory/4896-39-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-41-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-28-0x0000028F5F630000-0x0000028F5F638000-memory.dmp
memory/4896-31-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-32-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-34-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-33-0x0000028F5F780000-0x0000028F5F79C000-memory.dmp
memory/4896-35-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-36-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-37-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-38-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-17-0x00007FF97F35F000-0x00007FF97F360000-memory.dmp
memory/4896-40-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-30-0x0000028F784B0000-0x0000028F78692000-memory.dmp
memory/4896-42-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-43-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-44-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/4896-45-0x0000028F5FBB0000-0x0000028F5FBEA000-memory.dmp
memory/4896-46-0x0000028F5FC60000-0x0000028F5FCB0000-memory.dmp
memory/4896-47-0x0000028F79690000-0x0000028F79742000-memory.dmp
memory/4896-49-0x0000028F5FCB0000-0x0000028F5FCFE000-memory.dmp
memory/4896-50-0x0000028F5FD00000-0x0000028F5FD26000-memory.dmp
memory/4896-48-0x0000028F5FC10000-0x0000028F5FC5A000-memory.dmp
memory/4896-51-0x0000028F5FD30000-0x0000028F5FD64000-memory.dmp
memory/4896-52-0x0000028F79750000-0x0000028F7979C000-memory.dmp
memory/4896-53-0x0000028F797A0000-0x0000028F797EA000-memory.dmp
memory/4896-54-0x0000028F5FD70000-0x0000028F5FD9A000-memory.dmp
memory/4896-55-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp