quasar | 932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c

Analysis

max time kernel
145s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/12/2024, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe
Size

3.1MB
MD5

7ae9e9867e301a3fdd47d217b335d30f
SHA1

d8c62d8d73aeee1cbc714245f7a9a39fcfb80760
SHA256

932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c
SHA512

063648705e1817a1df82c9a595e4bbe8e0b1dbb7e31a6517df59905ebe7f22160f4acb55349d03dfe70744a14fd53c59a4c657c7a96646fcccf1c2214fc803dd
SSDEEP

49152:/vTlL26AaNeWgPhlmVqvMQ7XSKn8GE18hk/gv4oGdQTHHB72eh2NT:/vJL26AaNeWgPhlmVqkQ7XSKn8mA

Score

10^/10

quasar runtimebroker discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

Cmaster-57540.portmap.io:57540:8080

Mutex

7d0b5d0f-c185-4da8-b709-726d2f58400c

Attributes

encryption_key
6275D618DF6119CEEF062AB381785B6186B8C0EB
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
devtun

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 16 IoCs

resource	yara_rule
behavioral1/memory/1320-1-0x0000000000EB0000-0x00000000011D4000-memory.dmp	family_quasar
behavioral1/files/0x00370000000193e1-5.dat	family_quasar
behavioral1/memory/2704-9-0x00000000010A0000-0x00000000013C4000-memory.dmp	family_quasar
behavioral1/memory/2368-22-0x0000000001340000-0x0000000001664000-memory.dmp	family_quasar
behavioral1/memory/1720-33-0x00000000003B0000-0x00000000006D4000-memory.dmp	family_quasar
behavioral1/memory/2400-44-0x0000000000ED0000-0x00000000011F4000-memory.dmp	family_quasar
behavioral1/memory/2200-55-0x00000000001C0000-0x00000000004E4000-memory.dmp	family_quasar
behavioral1/memory/1820-67-0x0000000000D70000-0x0000000001094000-memory.dmp	family_quasar
behavioral1/memory/1008-78-0x00000000001D0000-0x00000000004F4000-memory.dmp	family_quasar
behavioral1/memory/2788-89-0x0000000000130000-0x0000000000454000-memory.dmp	family_quasar
behavioral1/memory/2604-100-0x00000000003D0000-0x00000000006F4000-memory.dmp	family_quasar
behavioral1/memory/484-111-0x0000000000A50000-0x0000000000D74000-memory.dmp	family_quasar
behavioral1/memory/1708-122-0x0000000000FF0000-0x0000000001314000-memory.dmp	family_quasar
behavioral1/memory/2104-134-0x00000000010C0000-0x00000000013E4000-memory.dmp	family_quasar
behavioral1/memory/2516-145-0x00000000013D0000-0x00000000016F4000-memory.dmp	family_quasar
behavioral1/memory/2780-166-0x0000000000200000-0x0000000000524000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2704	RuntimeBroker.exe
2368	RuntimeBroker.exe
1720	RuntimeBroker.exe
2400	RuntimeBroker.exe
2200	RuntimeBroker.exe
1820	RuntimeBroker.exe
1008	RuntimeBroker.exe
2788	RuntimeBroker.exe
2604	RuntimeBroker.exe
484	RuntimeBroker.exe
1708	RuntimeBroker.exe
2104	RuntimeBroker.exe
2516	RuntimeBroker.exe
3040	RuntimeBroker.exe
2780	RuntimeBroker.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\devtun\RuntimeBroker.exe	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe
File opened for modification	C:\Windows\system32\devtun\RuntimeBroker.exe	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
564	PING.EXE
1264	PING.EXE
900	PING.EXE
1736	PING.EXE
1712	PING.EXE
2060	PING.EXE
2148	PING.EXE
2804	PING.EXE
1528	PING.EXE
2580	PING.EXE
1984	PING.EXE
3056	PING.EXE
1536	PING.EXE
2740	PING.EXE
2800	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
564	PING.EXE
2740	PING.EXE
1712	PING.EXE
2060	PING.EXE
1536	PING.EXE
2580	PING.EXE
1984	PING.EXE
1264	PING.EXE
3056	PING.EXE
900	PING.EXE
2148	PING.EXE
2804	PING.EXE
1528	PING.EXE
1736	PING.EXE
2800	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1948	schtasks.exe
1592	schtasks.exe
1516	schtasks.exe
720	schtasks.exe
1684	schtasks.exe
2164	schtasks.exe
2052	schtasks.exe
2808	schtasks.exe
1764	schtasks.exe
2580	schtasks.exe
2516	schtasks.exe
2932	schtasks.exe
2352	schtasks.exe
2420	schtasks.exe
1560	schtasks.exe
2784	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe
Token: SeDebugPrivilege	2704	RuntimeBroker.exe
Token: SeDebugPrivilege	2368	RuntimeBroker.exe
Token: SeDebugPrivilege	1720	RuntimeBroker.exe
Token: SeDebugPrivilege	2400	RuntimeBroker.exe
Token: SeDebugPrivilege	2200	RuntimeBroker.exe
Token: SeDebugPrivilege	1820	RuntimeBroker.exe
Token: SeDebugPrivilege	1008	RuntimeBroker.exe
Token: SeDebugPrivilege	2788	RuntimeBroker.exe
Token: SeDebugPrivilege	2604	RuntimeBroker.exe
Token: SeDebugPrivilege	484	RuntimeBroker.exe
Token: SeDebugPrivilege	1708	RuntimeBroker.exe
Token: SeDebugPrivilege	2104	RuntimeBroker.exe
Token: SeDebugPrivilege	2516	RuntimeBroker.exe
Token: SeDebugPrivilege	3040	RuntimeBroker.exe
Token: SeDebugPrivilege	2780	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2784	1320	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe	30
PID 1320 wrote to memory of 2784	1320	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe	30
PID 1320 wrote to memory of 2784	1320	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe	30
PID 1320 wrote to memory of 2704	1320	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe	32
PID 1320 wrote to memory of 2704	1320	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe	32
PID 1320 wrote to memory of 2704	1320	932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe	32
PID 2704 wrote to memory of 2580	2704	RuntimeBroker.exe	33
PID 2704 wrote to memory of 2580	2704	RuntimeBroker.exe	33
PID 2704 wrote to memory of 2580	2704	RuntimeBroker.exe	33
PID 2704 wrote to memory of 2548	2704	RuntimeBroker.exe	35
PID 2704 wrote to memory of 2548	2704	RuntimeBroker.exe	35
PID 2704 wrote to memory of 2548	2704	RuntimeBroker.exe	35
PID 2548 wrote to memory of 2620	2548	cmd.exe	37
PID 2548 wrote to memory of 2620	2548	cmd.exe	37
PID 2548 wrote to memory of 2620	2548	cmd.exe	37
PID 2548 wrote to memory of 1984	2548	cmd.exe	38
PID 2548 wrote to memory of 1984	2548	cmd.exe	38
PID 2548 wrote to memory of 1984	2548	cmd.exe	38
PID 2548 wrote to memory of 2368	2548	cmd.exe	39
PID 2548 wrote to memory of 2368	2548	cmd.exe	39
PID 2548 wrote to memory of 2368	2548	cmd.exe	39
PID 2368 wrote to memory of 1684	2368	RuntimeBroker.exe	40
PID 2368 wrote to memory of 1684	2368	RuntimeBroker.exe	40
PID 2368 wrote to memory of 1684	2368	RuntimeBroker.exe	40
PID 2368 wrote to memory of 2584	2368	RuntimeBroker.exe	42
PID 2368 wrote to memory of 2584	2368	RuntimeBroker.exe	42
PID 2368 wrote to memory of 2584	2368	RuntimeBroker.exe	42
PID 2584 wrote to memory of 2408	2584	cmd.exe	44
PID 2584 wrote to memory of 2408	2584	cmd.exe	44
PID 2584 wrote to memory of 2408	2584	cmd.exe	44
PID 2584 wrote to memory of 1712	2584	cmd.exe	45
PID 2584 wrote to memory of 1712	2584	cmd.exe	45
PID 2584 wrote to memory of 1712	2584	cmd.exe	45
PID 2584 wrote to memory of 1720	2584	cmd.exe	46
PID 2584 wrote to memory of 1720	2584	cmd.exe	46
PID 2584 wrote to memory of 1720	2584	cmd.exe	46
PID 1720 wrote to memory of 1948	1720	RuntimeBroker.exe	47
PID 1720 wrote to memory of 1948	1720	RuntimeBroker.exe	47
PID 1720 wrote to memory of 1948	1720	RuntimeBroker.exe	47
PID 1720 wrote to memory of 2848	1720	RuntimeBroker.exe	49
PID 1720 wrote to memory of 2848	1720	RuntimeBroker.exe	49
PID 1720 wrote to memory of 2848	1720	RuntimeBroker.exe	49
PID 2848 wrote to memory of 1824	2848	cmd.exe	51
PID 2848 wrote to memory of 1824	2848	cmd.exe	51
PID 2848 wrote to memory of 1824	2848	cmd.exe	51
PID 2848 wrote to memory of 564	2848	cmd.exe	52
PID 2848 wrote to memory of 564	2848	cmd.exe	52
PID 2848 wrote to memory of 564	2848	cmd.exe	52
PID 2848 wrote to memory of 2400	2848	cmd.exe	53
PID 2848 wrote to memory of 2400	2848	cmd.exe	53
PID 2848 wrote to memory of 2400	2848	cmd.exe	53
PID 2400 wrote to memory of 2164	2400	RuntimeBroker.exe	54
PID 2400 wrote to memory of 2164	2400	RuntimeBroker.exe	54
PID 2400 wrote to memory of 2164	2400	RuntimeBroker.exe	54
PID 2400 wrote to memory of 900	2400	RuntimeBroker.exe	56
PID 2400 wrote to memory of 900	2400	RuntimeBroker.exe	56
PID 2400 wrote to memory of 900	2400	RuntimeBroker.exe	56
PID 900 wrote to memory of 844	900	cmd.exe	58
PID 900 wrote to memory of 844	900	cmd.exe	58
PID 900 wrote to memory of 844	900	cmd.exe	58
PID 900 wrote to memory of 1264	900	cmd.exe	59
PID 900 wrote to memory of 1264	900	cmd.exe	59
PID 900 wrote to memory of 1264	900	cmd.exe	59
PID 900 wrote to memory of 2200	900	cmd.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe
"C:\Users\Admin\AppData\Local\Temp\932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2784
- C:\Windows\system32\devtun\RuntimeBroker.exe
  "C:\Windows\system32\devtun\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2580
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\J2wiR59ojJ4A.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2620
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1984
  - - C:\Windows\system32\devtun\RuntimeBroker.exe
      "C:\Windows\system32\devtun\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2368
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1684
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\duUYFp3vbGpS.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2408
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1712
      - C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1948
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\yfOHJW3qGdZ6.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1824
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:564
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2164
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PHsZ7WSqKJyw.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:844
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1264
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1592
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\0fwPvVxoJcco.bat" "
        11⤵
        
        PID:2964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1796
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2060
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2516
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\fz6oCYTM4zon.bat" "
        13⤵
        
        PID:1248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:588
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2148
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1764
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sgmY5tHDX4rt.bat" "
        15⤵
        
        PID:1660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2800
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2804
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2932
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4TTS471ezO9e.bat" "
        17⤵
        
        PID:2884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3012
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3056
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1516
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qbpmHzoMKMkz.bat" "
        19⤵
        
        PID:2900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2020
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1536
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:484
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\pBmKdM2FYo5O.bat" "
        21⤵
        
        PID:1800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2864
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2740
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2352
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\xCbGJ8XzmQaU.bat" "
        23⤵
        
        PID:2996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:548
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:900
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:720
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\cmqaiMh6BRMt.bat" "
        25⤵
        
        PID:2768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1348
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1528
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2420
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\eafA5t5daOTR.bat" "
        27⤵
        
        PID:2304
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:772
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1736
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1560
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1o7p2Q4brgsH.bat" "
        29⤵
        
        PID:2972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2700
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2800
        
        C:\Windows\system32\devtun\RuntimeBroker.exe
        
        "C:\Windows\system32\devtun\RuntimeBroker.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\devtun\RuntimeBroker.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2808
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\eIZz7hW2efNQ.bat" "
        31⤵
        
        PID:2012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0fwPvVxoJcco.bat

Filesize
203B

MD5
f4165044140cc0e22ac6f23bf706ea9b

SHA1
f219b3129ffe082178260310f1bba0e512539d17

SHA256
0cdee9b3c4f2097f81cfa9006f91c03d55f7bb313c72f3148766e4334710e0fa

SHA512
eccbeb29dbe304140be9b953ec0959866a03569ce585d37568baa98b1ea3f08202e47b66d0b46809db429586903bbde31d0b1927dcda3cf37580e74d3366d0ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\1o7p2Q4brgsH.bat

Filesize
203B

MD5
5abe62979902874ff9792f9e40fab3ec

SHA1
76b0b46fa824719ebc7d5a0802ba337ff2f3d97b

SHA256
71c858fa93e88dad7cd2e83a6b691e0e6bcac8b72f655c0e856f0ae0fc3aeb63

SHA512
4ce8d93b4fd43ba94f38aad3e523cc9a012f28e99176498337c6aa3c8ae483568a72e79d6d631286db641ea4f9b084b7bb7a386639cdd2442f25f5242a56bb9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4TTS471ezO9e.bat

Filesize
203B

MD5
02b23ffbbf5b7b3f2c94615d56a4c277

SHA1
690819e308808afd8737af5b7287d56256347c6e

SHA256
ff7079796f5baf8d48d239ac2f724d9a8c8f84eb9a463a0d9808c789bebad9d4

SHA512
9e71e8fd417eb3cb7c46884abbcf130c6776284f01b0a22b55d9f5e8c7972c78ed4bba0ff9d7bd372bc60cd8f361963705d8a17aa08fbafb2d737c44cfaf7c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\J2wiR59ojJ4A.bat

Filesize
203B

MD5
4dd7e38deaedd939d22fbf057b934b6d

SHA1
0355c7461f53de5dcefd79cf942b189df22c6e7f

SHA256
c6c07e841aad6050ed01d29f0b75155672e8cb00594cd448765b2b1e844070a5

SHA512
865056262c11ac9428ca7a1c84a571e94db57b7879f200ab8bd8849831df58863e4f79bb18e2b6aecce0413887d2a7a285b6ed97f0568135a5dda5241d3e9501

Download Submit
C:\Users\Admin\AppData\Local\Temp\PHsZ7WSqKJyw.bat

Filesize
203B

MD5
f4a8e1714f2eddb99005ea59886cfab5

SHA1
95b59fce6ec6ab0e71a1bb0e4ca5482c580a27f5

SHA256
fcb4be79cdcaf27f72fb7e292a06b0e6d6c7af39a7acb76059384a8f19b061b8

SHA512
5cbd3324efb6193ee8a629f80826fc286b17592dd85481a750e41df7c22c87c360a45fbedf50f0547c8478f92b254b2fbb7c41b0749689e1167b916de02a0bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmqaiMh6BRMt.bat

Filesize
203B

MD5
980d8af15ea9d51edc403a3e37026648

SHA1
8ea6fa229d330fbb76ac88662879d4e4aa973bf9

SHA256
803ac1c03d26727c697de95def0700d26262ab520f956b9bb9c72ad9c56bf1c4

SHA512
71de7ee30d56c4eed56dc852d1417fbc89cdcc11898cf75eea933bf858a3065d0df973bd4f0c5683295d4f34182746975062dc1076524694ebaab9600932108a

Download Submit
C:\Users\Admin\AppData\Local\Temp\duUYFp3vbGpS.bat

Filesize
203B

MD5
631b51583cdec9264acfcf21f80f51b9

SHA1
3512d4cc29fb13173f9e8c867b014e68986c7f36

SHA256
542e6fbedd8f15d4edda86547247f067bcda35b0ae9c73708f0dae6782c34f85

SHA512
d40c94ef0faca24a26f7ad15c6c654ef66f0abe1af999be11ce2d13ab3e11ae1b4b1129ac78e122624fffe4b6d11dfccfe2ce922582c54e40103da78bc77061f

Download Submit
C:\Users\Admin\AppData\Local\Temp\eIZz7hW2efNQ.bat

Filesize
203B

MD5
acb190865db7f1e7cb0c2654cdf954ed

SHA1
3ea0da09d975efeab9d787c8b04d59d7cba2a0c2

SHA256
3de65340ce8f9802ff6e862b0ad5ef77193fe101723a2ba18200442a62f2160e

SHA512
120f9a00282ce19690cfe5fac6a4dea0717142229c76f779b382939b4668f8815020cd4a5a4fe72b4b9ead3b7de5e1a8c5c05df32599881a6e794746c2e0b150

Download Submit
C:\Users\Admin\AppData\Local\Temp\eafA5t5daOTR.bat

Filesize
203B

MD5
7ad1df67db33ec52976a3efcf63b32e8

SHA1
d6a8b27026c94a6668b124a9c068f201770f91bc

SHA256
8cd386cad7384134896df3ea1d3e0b1224ba041a378c697407bb3025eeec03af

SHA512
43aa52855394fa497ea5d99208e713bd42133eaf3c3c53050353bf1a2adb67448442b032595dce6caa9eec98079d1964a073ab038f3f3ac0fb540f1df4b1cba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fz6oCYTM4zon.bat

Filesize
203B

MD5
1a9923084b573e7188e49372a1f04426

SHA1
d6368bb1e7e8206b88b0b6d9aed42e7ea4789d85

SHA256
a0c857257a99e817fa11cd3fb930f2d0e41dfc90f104d8253041f312c781a806

SHA512
8273dcdd08f593025f478300e0f305a9368e412936cb6488784225d510d698be098728e4047f1d56ce8912a80fadcdb8493ead9578eb9442cee73a22f9e1c1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\pBmKdM2FYo5O.bat

Filesize
203B

MD5
06a763164277607cf6f2007374638cbd

SHA1
a9a87a6f9dff42379e2f32e2c67b537263846043

SHA256
04bf03bc788781bd4c2a2b3c4f87a7848d8f71850637991332f333acdc0bdcd0

SHA512
ca86faca8353a671b8dd87b5c6aef5bf8ce6f515b70c94aff51479b352de8ec29f1826d2079aa6c839829c0920e82a9da7b5f3a2c1a601bdf21758ee62e870ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbpmHzoMKMkz.bat

Filesize
203B

MD5
1c47d7f97b723dcd947581e7b433a504

SHA1
8d8cf1b8f994e56c06122c4607865f5dbc3edfab

SHA256
7b428c7cfe0db722d3d7beedc86bbb02ffcb8bcb5b898d1f836f084b3f418e39

SHA512
f558ad0fe61cb5e94c5dc5301f3e539197f846c4f4c5e318e158caeb101286784b69e5d23a164152ec747cce98272490b360cbda8bf2b666c7d7437d7e359780

Download Submit
C:\Users\Admin\AppData\Local\Temp\sgmY5tHDX4rt.bat

Filesize
203B

MD5
16bca03e5ccbe6225dcc116feecbe87f

SHA1
b6cdd3b04eb8ed0573b391cce34ab0a17910569a

SHA256
097cb540127d048a2284a6873eea164dbfe7087cf1976b0980737e6f3960ec28

SHA512
6d02e60c9d42c9a8ce31697d4654062ca2a1240e155b2cef7f5e46794a44729f5be081c5f62bbccf117b0c054642c17483c59e7b01f7eb01ea375653e37992ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\xCbGJ8XzmQaU.bat

Filesize
203B

MD5
25ad5edf9c6e93cccb569d26c035ec04

SHA1
c7241af472cb03a8a3c644ee8f6efa1c06cd881c

SHA256
0374a78d8bcc3619408c503c0c514ba4bd763e1f762d062df266798eba0bc768

SHA512
caff241475a1c16cce8b91a6b77b9b8954036f045917f39dfd089d8e5b94162f167a920372e5ed08b0a952b2b679a383107bbb20afacc7a67f895389cc6a784b

Download Submit
C:\Users\Admin\AppData\Local\Temp\yfOHJW3qGdZ6.bat

Filesize
203B

MD5
8ee4537f1b39b40fbb3b0a0988cd2ac9

SHA1
6f88b18ff19ef00cf676fcc0cedbce90f646c4d4

SHA256
cc6640724ad228f000ae8acfac6aca7927e4d4b60143acd04ac6508d93ae665a

SHA512
98de8eb70f234db6c579137f910040742aa4de753394200a00e56ac98fa102911906bd56307291c7a31c2d6c5142fdf5f8b6f692e67ecf2a8da25700f524bcba

Download Submit
C:\Windows\System32\devtun\RuntimeBroker.exe

Filesize
3.1MB

MD5
7ae9e9867e301a3fdd47d217b335d30f

SHA1
d8c62d8d73aeee1cbc714245f7a9a39fcfb80760

SHA256
932cb7b1080180487be4b5754bd92600409bafda80d412018a792a8930c6a46c

SHA512
063648705e1817a1df82c9a595e4bbe8e0b1dbb7e31a6517df59905ebe7f22160f4acb55349d03dfe70744a14fd53c59a4c657c7a96646fcccf1c2214fc803dd

Download Submit
memory/484-111-0x0000000000A50000-0x0000000000D74000-memory.dmp

Filesize
3.1MB

Download
memory/1008-78-0x00000000001D0000-0x00000000004F4000-memory.dmp

Filesize
3.1MB

Download
memory/1320-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/1320-1-0x0000000000EB0000-0x00000000011D4000-memory.dmp

Filesize
3.1MB

Download
memory/1320-2-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1320-8-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1708-122-0x0000000000FF0000-0x0000000001314000-memory.dmp

Filesize
3.1MB

Download
memory/1720-33-0x00000000003B0000-0x00000000006D4000-memory.dmp

Filesize
3.1MB

Download
memory/1820-67-0x0000000000D70000-0x0000000001094000-memory.dmp

Filesize
3.1MB

Download
memory/2104-134-0x00000000010C0000-0x00000000013E4000-memory.dmp

Filesize
3.1MB

Download
memory/2200-55-0x00000000001C0000-0x00000000004E4000-memory.dmp

Filesize
3.1MB

Download
memory/2368-22-0x0000000001340000-0x0000000001664000-memory.dmp

Filesize
3.1MB

Download
memory/2400-44-0x0000000000ED0000-0x00000000011F4000-memory.dmp

Filesize
3.1MB

Download
memory/2516-145-0x00000000013D0000-0x00000000016F4000-memory.dmp

Filesize
3.1MB

Download
memory/2604-100-0x00000000003D0000-0x00000000006F4000-memory.dmp

Filesize
3.1MB

Download
memory/2704-10-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-7-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-9-0x00000000010A0000-0x00000000013C4000-memory.dmp

Filesize
3.1MB

Download
memory/2704-19-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2780-166-0x0000000000200000-0x0000000000524000-memory.dmp

Filesize
3.1MB

Download
memory/2788-89-0x0000000000130000-0x0000000000454000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads