Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/10/2026, 23:22
General
- Target 2026-10-15_0d6291830bfee8fee7eff2ba40c51e24_coinminer_elex_glassworm_icedid_luca-stealer_mass-logger.exe
- Size 19.9MB
- Sample261016-3ctqxsys3r
- SHA256 d9ab2a4864af6713937a7c21aa0aa0935be2834496a33e09c19236a8a425d34f
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
217.60.195.228:57122
-
d8d65547-d4fb-4283-90c2-b80ecdd92343
-
encryption_key
A18388F29F2F6C4FDEB2301666774ED50C14A15C
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Quasar payload 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
- Detects executables containing common artifacts observed in infostealers 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
- XMRig Miner payload 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_0d6291830bfee8fee7eff2ba40c51e24_coinminer_elex_glassworm_icedid_luca-stealer_mass-logger.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_0d6291830bfee8fee7eff2ba40c51e24_coinminer_elex_glassworm_icedid_luca-stealer_mass-logger.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5880-0-0x00007FF94FF7F000-0x00007FF94FF80000-memory.dmp
memory/5880-2-0x0000000000820000-0x0000000001C14000-memory.dmp
memory/5880-1-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-3-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-4-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-5-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-6-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-7-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-8-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-9-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-10-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-11-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-12-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp
memory/5880-13-0x000000001DAE0000-0x000000001DB30000-memory.dmp
memory/5880-14-0x000000001DBF0000-0x000000001DCA2000-memory.dmp
memory/5880-15-0x00007FF94FDF0000-0x00007FF950794000-memory.dmp