Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 19:58
General
- Target 2026-09-29_66b4c07c3ec3b602e812cbeab52e25ed_blackenergy_icedid_luca-stealer_njrat_stealc.exe
- Size 2.8MB
- Sample260930-ypzeqagh94
- SHA256 f7f3e6a999f43870a81ef2c5c4adb9d8ceba89608e7ae6d95f39ab399ffb5f5d
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.6.6
Botnet
-
Pela Gaya
C2
-
80.225.198.143:9717
Mutex
-
7c0604c2-435d-4941-99c4-80bb0169dcdf
Attributes
-
encryption_key
7799F230382DEC15CFC54F1D560B5A8B875621D2
-
install_name
Discord.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
-
startup_key
SecurityHealthService
-
subdirectory
Discord
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables manipulated with Fody 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_66b4c07c3ec3b602e812cbeab52e25ed_blackenergy_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_66b4c07c3ec3b602e812cbeab52e25ed_blackenergy_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-2-0x0000015E7B5B0000-0x0000015E7B84E000-memory.dmp
memory/1124-7-0x0000015E7B5B0000-0x0000015E7B84E000-memory.dmp
memory/6116-1-0x00007FFCECB3F000-0x00007FFCECB40000-memory.dmp
memory/6116-0-0x00007FFCEC9E0000-0x00007FFCECC43000-memory.dmp