Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/10/2026, 11:23
General
- Target 2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat.exe
- Size 4.5MB
- Sample261025-ng7e9avy8j
- SHA256 5b26d8de37d9ce27798a7eff03d4da8b4437a9bc3146f3f412186990a038e505
Malware Config
Signatures
- Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Detects ChromElevator 1 IoCs
- PulsaRAT library module 2 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Detects executables referencing virtualization MAC addresses 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5076-1-0x000002374FD90000-0x000002375020A000-memory.dmp
memory/5076-0-0x00007FFECBC1F000-0x00007FFECBC20000-memory.dmp
memory/5076-2-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-3-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-4-0x0000023750670000-0x00000237506AC000-memory.dmp
memory/5076-5-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-6-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-7-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-8-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-9-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-10-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-11-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-12-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-13-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-14-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-15-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-16-0x000002376A7F0000-0x000002376A82E000-memory.dmp
memory/5076-17-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp
memory/5076-18-0x00007FFECBA90000-0x00007FFECC434000-memory.dmp