Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 04:26
General
- Target 2026-11-05_378fd5cc7ba2f94a096be155d6c0eacb_elex_ghostweaver_glassworm_icedid_luca-stealer_njrat_poe.exe
- Size 9.6MB
- Sample261107-e2qtkavzht
- SHA256 9fc13588a7d032b1aeb6af598a573ac2e9f8fa521350a1d2c1e7979ed3cd7638
Malware Config
Signatures
- Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Detects ChromElevator 1 IoCs
- PulsaRAT library module 2 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 1 IoCs
- Custom signatureDetect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 1 IoCs
- Custom signatureDetects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Custom signatureDetects encrypted or obfuscated .NET executables 1 IoCs
- Custom signatureDetects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
- Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Custom signatureDetects executables manipulated with Fody 1 IoCs
- Custom signatureDetects executables referencing many IR and analysis tools 1 IoCs
- Custom signatureDetects executables referencing virtualization MAC addresses 1 IoCs
- Custom signaturedetects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-05_378fd5cc7ba2f94a096be155d6c0eacb_elex_ghostweaver_glassworm_icedid_luca-stealer_njrat_poe.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-05_378fd5cc7ba2f94a096be155d6c0eacb_elex_ghostweaver_glassworm_icedid_luca-stealer_njrat_poe.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4260-0-0x00007FFFED53F000-0x00007FFFED540000-memory.dmp
memory/4260-1-0x0000026899B70000-0x000002689A506000-memory.dmp
memory/4260-2-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-3-0x00000268B49D0000-0x00000268B4A14000-memory.dmp
memory/4260-4-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-5-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-6-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-7-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-8-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-9-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-10-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-11-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-12-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-13-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-14-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-15-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/4260-16-0x00000268B4C10000-0x00000268B4C4E000-memory.dmp
memory/4260-17-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp