quasar | f5acec48afbdd2a4850462e4613ce91c983bc3a3498c69a306a4ca12ccd15de0

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

3.1MB
MD5

e45a6c438c6ab1538b44fc43a242a5d3
SHA1

00a85654779955ca989d1f2907ea1831b2511688
SHA256

f5acec48afbdd2a4850462e4613ce91c983bc3a3498c69a306a4ca12ccd15de0
SHA512

806783dfc96b3a97c11675236d31f10c6540668e6149ab158eea680b0f84248b7b25ba4f36b4790250459b87e2b0bc91d551b07a79e236c8a4356df4f3878a6f
SSDEEP

49152:LvelL26AaNeWgPhlmVqvMQ7XSKybCaSmz/ZoGdmTHHB72eh2NT:LvOL26AaNeWgPhlmVqkQ7XSKoCaZ

Score

10^/10

quasar stealer spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Stealer

battery-stripes.gl.at.ply.gg:26129

Mutex

b5481c41-4bb5-4640-a5ee-20f5c734de54

Attributes

encryption_key
FA1E38D5CB08766F486F72A0AB91AE27E1725C2B
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Runtime Broker
subdirectory
WD

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4708-1-0x00000000000F0000-0x0000000000414000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe	family_quasar

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Runtime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe

Executes dropped EXE 10 IoCs

Processes:

Runtime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exe

pid	process
1904	Runtime Broker.exe
3152	Runtime Broker.exe
1748	Runtime Broker.exe
4320	Runtime Broker.exe
1884	Runtime Broker.exe
4420	Runtime Broker.exe
1312	Runtime Broker.exe
928	Runtime Broker.exe
2184	Runtime Broker.exe
3596	Runtime Broker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2420	schtasks.exe
4404	schtasks.exe
1388	schtasks.exe
3540	schtasks.exe
4580	schtasks.exe
1548	schtasks.exe
2640	schtasks.exe
744	schtasks.exe
1776	schtasks.exe
4460	schtasks.exe
4764	schtasks.exe

Runs ping.exe 1 TTPs 9 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

4076 PING.EXE
1900 PING.EXE
3788 PING.EXE
3428 PING.EXE
1284 PING.EXE
1236 PING.EXE
2416 PING.EXE
3384 PING.EXE
5096 PING.EXE

pid	process
4076	PING.EXE
1900	PING.EXE
3788	PING.EXE
3428	PING.EXE
1284	PING.EXE
1236	PING.EXE
2416	PING.EXE
3384	PING.EXE
5096	PING.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

Server.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exe

description	pid	process
Token: SeDebugPrivilege	4708	Server.exe
Token: SeDebugPrivilege	1904	Runtime Broker.exe
Token: SeDebugPrivilege	3152	Runtime Broker.exe
Token: SeDebugPrivilege	1748	Runtime Broker.exe
Token: SeDebugPrivilege	4320	Runtime Broker.exe
Token: SeDebugPrivilege	1884	Runtime Broker.exe
Token: SeDebugPrivilege	4420	Runtime Broker.exe
Token: SeDebugPrivilege	1312	Runtime Broker.exe
Token: SeDebugPrivilege	928	Runtime Broker.exe
Token: SeDebugPrivilege	2184	Runtime Broker.exe
Token: SeDebugPrivilege	3596	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Runtime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exe

pid process

1904 Runtime Broker.exe
4420 Runtime Broker.exe
1312 Runtime Broker.exe
928 Runtime Broker.exe
2184 Runtime Broker.exe
3596 Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Server.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exe

description	pid	process	target process
PID 4708 wrote to memory of 2640	4708	Server.exe	schtasks.exe
PID 4708 wrote to memory of 2640	4708	Server.exe	schtasks.exe
PID 4708 wrote to memory of 1904	4708	Server.exe	Runtime Broker.exe
PID 4708 wrote to memory of 1904	4708	Server.exe	Runtime Broker.exe
PID 1904 wrote to memory of 2420	1904	Runtime Broker.exe	schtasks.exe
PID 1904 wrote to memory of 2420	1904	Runtime Broker.exe	schtasks.exe
PID 1904 wrote to memory of 1996	1904	Runtime Broker.exe	cmd.exe
PID 1904 wrote to memory of 1996	1904	Runtime Broker.exe	cmd.exe
PID 1996 wrote to memory of 3444	1996	cmd.exe	chcp.com
PID 1996 wrote to memory of 3444	1996	cmd.exe	chcp.com
PID 1996 wrote to memory of 1284	1996	cmd.exe	PING.EXE
PID 1996 wrote to memory of 1284	1996	cmd.exe	PING.EXE
PID 1996 wrote to memory of 3152	1996	cmd.exe	Runtime Broker.exe
PID 1996 wrote to memory of 3152	1996	cmd.exe	Runtime Broker.exe
PID 3152 wrote to memory of 4404	3152	Runtime Broker.exe	schtasks.exe
PID 3152 wrote to memory of 4404	3152	Runtime Broker.exe	schtasks.exe
PID 3152 wrote to memory of 3540	3152	Runtime Broker.exe	cmd.exe
PID 3152 wrote to memory of 3540	3152	Runtime Broker.exe	cmd.exe
PID 3540 wrote to memory of 1844	3540	cmd.exe	chcp.com
PID 3540 wrote to memory of 1844	3540	cmd.exe	chcp.com
PID 3540 wrote to memory of 4076	3540	cmd.exe	PING.EXE
PID 3540 wrote to memory of 4076	3540	cmd.exe	PING.EXE
PID 3540 wrote to memory of 1748	3540	cmd.exe	Runtime Broker.exe
PID 3540 wrote to memory of 1748	3540	cmd.exe	Runtime Broker.exe
PID 1748 wrote to memory of 744	1748	Runtime Broker.exe	schtasks.exe
PID 1748 wrote to memory of 744	1748	Runtime Broker.exe	schtasks.exe
PID 1748 wrote to memory of 4612	1748	Runtime Broker.exe	cmd.exe
PID 1748 wrote to memory of 4612	1748	Runtime Broker.exe	cmd.exe
PID 4612 wrote to memory of 4360	4612	cmd.exe	chcp.com
PID 4612 wrote to memory of 4360	4612	cmd.exe	chcp.com
PID 4612 wrote to memory of 1236	4612	cmd.exe	PING.EXE
PID 4612 wrote to memory of 1236	4612	cmd.exe	PING.EXE
PID 4612 wrote to memory of 4320	4612	cmd.exe	Runtime Broker.exe
PID 4612 wrote to memory of 4320	4612	cmd.exe	Runtime Broker.exe
PID 4320 wrote to memory of 1776	4320	Runtime Broker.exe	schtasks.exe
PID 4320 wrote to memory of 1776	4320	Runtime Broker.exe	schtasks.exe
PID 4320 wrote to memory of 1148	4320	Runtime Broker.exe	cmd.exe
PID 4320 wrote to memory of 1148	4320	Runtime Broker.exe	cmd.exe
PID 1148 wrote to memory of 2352	1148	cmd.exe	chcp.com
PID 1148 wrote to memory of 2352	1148	cmd.exe	chcp.com
PID 1148 wrote to memory of 2416	1148	cmd.exe	PING.EXE
PID 1148 wrote to memory of 2416	1148	cmd.exe	PING.EXE
PID 1148 wrote to memory of 1884	1148	cmd.exe	Runtime Broker.exe
PID 1148 wrote to memory of 1884	1148	cmd.exe	Runtime Broker.exe
PID 1884 wrote to memory of 4460	1884	Runtime Broker.exe	schtasks.exe
PID 1884 wrote to memory of 4460	1884	Runtime Broker.exe	schtasks.exe
PID 1884 wrote to memory of 4016	1884	Runtime Broker.exe	cmd.exe
PID 1884 wrote to memory of 4016	1884	Runtime Broker.exe	cmd.exe
PID 4016 wrote to memory of 5108	4016	cmd.exe	chcp.com
PID 4016 wrote to memory of 5108	4016	cmd.exe	chcp.com
PID 4016 wrote to memory of 1900	4016	cmd.exe	PING.EXE
PID 4016 wrote to memory of 1900	4016	cmd.exe	PING.EXE
PID 4016 wrote to memory of 4420	4016	cmd.exe	Runtime Broker.exe
PID 4016 wrote to memory of 4420	4016	cmd.exe	Runtime Broker.exe
PID 4420 wrote to memory of 4764	4420	Runtime Broker.exe	schtasks.exe
PID 4420 wrote to memory of 4764	4420	Runtime Broker.exe	schtasks.exe
PID 4420 wrote to memory of 1520	4420	Runtime Broker.exe	cmd.exe
PID 4420 wrote to memory of 1520	4420	Runtime Broker.exe	cmd.exe
PID 1520 wrote to memory of 4520	1520	cmd.exe	chcp.com
PID 1520 wrote to memory of 4520	1520	cmd.exe	chcp.com
PID 1520 wrote to memory of 3788	1520	cmd.exe	PING.EXE
PID 1520 wrote to memory of 3788	1520	cmd.exe	PING.EXE
PID 1520 wrote to memory of 1312	1520	cmd.exe	Runtime Broker.exe
PID 1520 wrote to memory of 1312	1520	cmd.exe	Runtime Broker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2640

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZgOFYQGD7GdB.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:3444

C:\Windows\system32\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:1284

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kfpcDxRKldQs.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:1844

C:\Windows\system32\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:4076

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GhRi7bwmFfU8.bat" "
7⤵
- Suspicious use of WriteProcessMemory
PID:4612

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:4360

C:\Windows\system32\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:1236

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cZkjQhzBng59.bat" "
9⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\chcp.com
chcp 65001
10⤵
PID:2352

C:\Windows\system32\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:2416

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
11⤵
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EtitBYxhwK9T.bat" "
11⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\system32\chcp.com
chcp 65001
12⤵
PID:5108

C:\Windows\system32\PING.EXE
ping -n 10 localhost
12⤵
- Runs ping.exe
PID:1900

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
13⤵
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gR2GQ7lkuif3.bat" "
13⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\system32\chcp.com
chcp 65001
14⤵
PID:4520

C:\Windows\system32\PING.EXE
ping -n 10 localhost
14⤵
- Runs ping.exe
PID:3788

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1312

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
15⤵
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BNJxgWdkIKCb.bat" "
15⤵
PID:3444

C:\Windows\system32\chcp.com
chcp 65001
16⤵
PID:4864

C:\Windows\system32\PING.EXE
ping -n 10 localhost
16⤵
- Runs ping.exe
PID:3384

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:928

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
17⤵
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jbr82g8PyY4s.bat" "
17⤵
PID:1324

C:\Windows\system32\chcp.com
chcp 65001
18⤵
PID:1656

C:\Windows\system32\PING.EXE
ping -n 10 localhost
18⤵
- Runs ping.exe
PID:5096

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2184

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
19⤵
- Creates scheduled task(s)
PID:3540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7BSb3BGgcHRX.bat" "
19⤵
PID:3244

C:\Windows\system32\chcp.com
chcp 65001
20⤵
PID:3628

C:\Windows\system32\PING.EXE
ping -n 10 localhost
20⤵
- Runs ping.exe
PID:3428

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3596

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
21⤵
- Creates scheduled task(s)
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Runtime Broker.exe.log
Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7BSb3BGgcHRX.bat
Filesize
211B

MD5
3f41dde0b4f76241e6c4b09ad729c186

SHA1
3224e2beda5a76cd0d6e12ffd8196102eb6e02fa

SHA256
602347b4ccd424cb20b544ccf393b82d9a2c658dc73ef9bbbd890e19005d5edc

SHA512
1385c5b34f151ea73169c89bd3f02c9e81790643df1252ab139326ecfd28e8934cc4186db98e08d2cc7efbd23bd7f7fca08de362c47a08d141b9d22b99f1c1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\BNJxgWdkIKCb.bat
Filesize
211B

MD5
9b212a9ec3cc29716fd6d65c6fc7ac54

SHA1
4344e177692679e9437bf8151a88fc04f2e197df

SHA256
45c1ea4ca877b059f60b7041c92d929de312e0e2160a55f903338e7b75105d23

SHA512
8ea6f2dfb6d1637edf0680b32b8c0066926a45f0e7ad8ed1c110af3b29af55c7573a184eccba5f56815ce0b3ed45efcfe568c48c802f7f90f1984dbd8e548509

Download Submit
C:\Users\Admin\AppData\Local\Temp\EtitBYxhwK9T.bat
Filesize
211B

MD5
271e9a5e111f6c018795adc0163fa3b2

SHA1
aab2237c9594f88bdbb0c6d1cb341a29ef10ece0

SHA256
8bcbb9474c772162166bb857bb14f73f7021a328b1f970c738abbedb02955d27

SHA512
16ab8d948c8f6e2438a56207960e4af65dd412af7547a246a58cfb0cc91f29cbed5238ff7d28759b049fcea82228665913f9b60fe7366a18a98b9b7040d644fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\GhRi7bwmFfU8.bat
Filesize
211B

MD5
267675d28b8239ebe3916f20fe928af4

SHA1
c7a841b2c571f18764b3bf66053cb621b5d32028

SHA256
2906684caaf409a2e3d430e64a5df0783e78c643cebe6659ea3de3408d6246fe

SHA512
c0e83203230eff279caf469bf4514d5b20bff863a97e4f54e96071d670ad5d154d5fd177b4fe59daab05d3ce94c2ebb89f4f6f029f30df48f2cee483bd26b876

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZgOFYQGD7GdB.bat
Filesize
211B

MD5
e362e02a46d232bf067abe83bb004692

SHA1
1e8f882b8a52ce4b84ecb5315cce3d5a2a48c9cd

SHA256
68a2772d6f906c19f769f7752c5ee67068989e538b81f53f57914266b0b334ec

SHA512
390b4a635ce3a6f524f84a38738ea8796ae1d189d469e7da9157a51e446e6fb4f758a16a70ae182ab7834825938af5752d7414d508b2a3c180e42d864ac7bed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cZkjQhzBng59.bat
Filesize
211B

MD5
32eec2c01df7647ba4481f04ffa3c692

SHA1
94a3d2c505b6e8de38b3fe074cd7bd6df9069a7e

SHA256
fe3a2b26f7e4186d9a44d94068dec885c72bbed20b46f60a3959ce960d5ab342

SHA512
8d1602f37f7be8d676469cc5b18690a2e69d95166f85ddf0cbc6a5cb31e195753a4f6e2043a1fbe7124f087e4718daa04c3eecaadc381c51ea3edb59104452cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\gR2GQ7lkuif3.bat
Filesize
211B

MD5
11093a9844eec0f768d36d169026bd9a

SHA1
d48961fc1b0a01fc50e627718b18b2d1104431c3

SHA256
a99a81f7b5b614e188c2b8e006b4c5023fff1c169c31f9c6d20354dc01a100a7

SHA512
aac73a354acccdb44f6855a372da694a35fb5a75c0a452d93a2a5a1cbca064073f72bff9f3b2732188667c3f620856b34546d1e19e402bba6357adc7724dd48a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jbr82g8PyY4s.bat
Filesize
211B

MD5
b5f91028726b46ab45f426968cb98b6c

SHA1
6825a88eda3fc12f1f45008a96c47c61bbdae3b4

SHA256
da75a7b594037c8d42ff666ed2116e1db3c07911915b694dbebfb045d2375f38

SHA512
f1ece1d69a6f77edf91122d784ec21440f55bff9502092e376988e3cbbcb661d305236d992de89fd3175a4ad6e5d2cfed33f16bb0e10337d92c1efca6d3f20a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\kfpcDxRKldQs.bat
Filesize
211B

MD5
f89136d4aad1226fe28993364029bbfb

SHA1
02895d23e4c7a8b9874bd2aa4060f6cad5c3ca83

SHA256
cc2a1aab4b4f2cb3622a9d3e60268444f137c759e65bf74a8460eb0701430099

SHA512
b75fba159fbd7ccd82cad7a4a4b780498106704a39c99127e7b9d32d75b614cb1d31edb457593be3e34d75c7d93c53013028bb1ebe02c9888292f8d33a2912c0

Download Submit
C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
Filesize
3.1MB

MD5
e45a6c438c6ab1538b44fc43a242a5d3

SHA1
00a85654779955ca989d1f2907ea1831b2511688

SHA256
f5acec48afbdd2a4850462e4613ce91c983bc3a3498c69a306a4ca12ccd15de0

SHA512
806783dfc96b3a97c11675236d31f10c6540668e6149ab158eea680b0f84248b7b25ba4f36b4790250459b87e2b0bc91d551b07a79e236c8a4356df4f3878a6f

Download Submit
memory/1904-10-0x00007FFE444A0000-0x00007FFE44F61000-memory.dmp

Filesize
10.8MB

Download
memory/1904-18-0x00007FFE444A0000-0x00007FFE44F61000-memory.dmp

Filesize
10.8MB

Download
memory/1904-11-0x00007FFE444A0000-0x00007FFE44F61000-memory.dmp

Filesize
10.8MB

Download
memory/1904-13-0x000000001DE30000-0x000000001DEE2000-memory.dmp

Filesize
712KB

Download
memory/1904-12-0x000000001BD20000-0x000000001BD70000-memory.dmp

Filesize
320KB

Download
memory/4708-0-0x00007FFE444A3000-0x00007FFE444A5000-memory.dmp

Filesize
8KB

Download
memory/4708-9-0x00007FFE444A0000-0x00007FFE44F61000-memory.dmp

Filesize
10.8MB

Download
memory/4708-2-0x00007FFE444A0000-0x00007FFE44F61000-memory.dmp

Filesize
10.8MB

Download
memory/4708-1-0x00000000000F0000-0x0000000000414000-memory.dmp

Filesize
3.1MB

Download