quasar | cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

dd7a806c734df62ecf4802977fa0b3e9
SHA1

42eae42e0fcfe9d9a54e493a670adde5241377da
SHA256

cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f
SHA512

0f8e2e565b40baabdde4018db57e06aee8e8dfeb4b1491e8e02e56a20e6b55bc1130ed74a702c35e043d4886af969af5d8ca26f5caeb0e96694982ecfbc80bbf
SSDEEP

49152:yvkt62XlaSFNWPjljiFa2RoUYIO8RJ6IbR3LoGdaTHHB72eh2NT:yv462XlaSFNWPjljiFXRoUYIO8RJ6i

Score

10^/10

quasar aryszx discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Aryszx

Apichat:4782

Mutex

181f4a12-4cad-46a9-9896-1001033c5b69

Attributes

encryption_key
F4F359BEF442D9221F73F7D64267E0E300CC68CE
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
1
startup_key
Runtime Broker

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral1/memory/1736-1-0x0000000000F50000-0x0000000001274000-memory.dmp	family_quasar
behavioral1/files/0x000a0000000120d6-6.dat	family_quasar
behavioral1/memory/2340-9-0x0000000001200000-0x0000000001524000-memory.dmp	family_quasar
behavioral1/memory/1808-75-0x0000000000050000-0x0000000000374000-memory.dmp	family_quasar
behavioral1/memory/2652-87-0x0000000000390000-0x00000000006B4000-memory.dmp	family_quasar
behavioral1/memory/2596-98-0x0000000000AD0000-0x0000000000DF4000-memory.dmp	family_quasar
behavioral1/memory/1760-110-0x0000000000DA0000-0x00000000010C4000-memory.dmp	family_quasar
behavioral1/memory/2264-121-0x0000000000F90000-0x00000000012B4000-memory.dmp	family_quasar

Executes dropped EXE 12 IoCs

pid	Process
2340	Runtime Broker.exe
2720	Runtime Broker.exe
1032	Runtime Broker.exe
2116	Runtime Broker.exe
1884	Runtime Broker.exe
1652	Runtime Broker.exe
1808	Runtime Broker.exe
2652	Runtime Broker.exe
2596	Runtime Broker.exe
1760	Runtime Broker.exe
2264	Runtime Broker.exe
2024	Runtime Broker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1120	PING.EXE
2868	PING.EXE
2224	PING.EXE
1240	PING.EXE
1484	PING.EXE
1960	PING.EXE
1056	PING.EXE
1968	PING.EXE
2624	PING.EXE
2548	PING.EXE
764	PING.EXE
1736	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
2868	PING.EXE
1968	PING.EXE
2548	PING.EXE
2224	PING.EXE
764	PING.EXE
1736	PING.EXE
1484	PING.EXE
1960	PING.EXE
2624	PING.EXE
1120	PING.EXE
1240	PING.EXE
1056	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2380	schtasks.exe
2084	schtasks.exe
2864	schtasks.exe
1516	schtasks.exe
468	schtasks.exe
2464	schtasks.exe
2812	schtasks.exe
776	schtasks.exe
1332	schtasks.exe
528	schtasks.exe
276	schtasks.exe
2624	schtasks.exe
1728	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	Client-built.exe
Token: SeDebugPrivilege	2340	Runtime Broker.exe
Token: SeDebugPrivilege	2720	Runtime Broker.exe
Token: SeDebugPrivilege	1032	Runtime Broker.exe
Token: SeDebugPrivilege	2116	Runtime Broker.exe
Token: SeDebugPrivilege	1884	Runtime Broker.exe
Token: SeDebugPrivilege	1652	Runtime Broker.exe
Token: SeDebugPrivilege	1808	Runtime Broker.exe
Token: SeDebugPrivilege	2652	Runtime Broker.exe
Token: SeDebugPrivilege	2596	Runtime Broker.exe
Token: SeDebugPrivilege	1760	Runtime Broker.exe
Token: SeDebugPrivilege	2264	Runtime Broker.exe
Token: SeDebugPrivilege	2024	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2340	Runtime Broker.exe
2720	Runtime Broker.exe
1032	Runtime Broker.exe
2116	Runtime Broker.exe
1884	Runtime Broker.exe
1652	Runtime Broker.exe
1808	Runtime Broker.exe
2652	Runtime Broker.exe
2596	Runtime Broker.exe
1760	Runtime Broker.exe
2264	Runtime Broker.exe
2024	Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2464	1736	Client-built.exe	30
PID 1736 wrote to memory of 2464	1736	Client-built.exe	30
PID 1736 wrote to memory of 2464	1736	Client-built.exe	30
PID 1736 wrote to memory of 2340	1736	Client-built.exe	32
PID 1736 wrote to memory of 2340	1736	Client-built.exe	32
PID 1736 wrote to memory of 2340	1736	Client-built.exe	32
PID 2340 wrote to memory of 2812	2340	Runtime Broker.exe	33
PID 2340 wrote to memory of 2812	2340	Runtime Broker.exe	33
PID 2340 wrote to memory of 2812	2340	Runtime Broker.exe	33
PID 2340 wrote to memory of 1152	2340	Runtime Broker.exe	35
PID 2340 wrote to memory of 1152	2340	Runtime Broker.exe	35
PID 2340 wrote to memory of 1152	2340	Runtime Broker.exe	35
PID 1152 wrote to memory of 2832	1152	cmd.exe	37
PID 1152 wrote to memory of 2832	1152	cmd.exe	37
PID 1152 wrote to memory of 2832	1152	cmd.exe	37
PID 1152 wrote to memory of 2624	1152	cmd.exe	38
PID 1152 wrote to memory of 2624	1152	cmd.exe	38
PID 1152 wrote to memory of 2624	1152	cmd.exe	38
PID 1152 wrote to memory of 2720	1152	cmd.exe	40
PID 1152 wrote to memory of 2720	1152	cmd.exe	40
PID 1152 wrote to memory of 2720	1152	cmd.exe	40
PID 2720 wrote to memory of 2380	2720	Runtime Broker.exe	41
PID 2720 wrote to memory of 2380	2720	Runtime Broker.exe	41
PID 2720 wrote to memory of 2380	2720	Runtime Broker.exe	41
PID 2720 wrote to memory of 2984	2720	Runtime Broker.exe	43
PID 2720 wrote to memory of 2984	2720	Runtime Broker.exe	43
PID 2720 wrote to memory of 2984	2720	Runtime Broker.exe	43
PID 2984 wrote to memory of 992	2984	cmd.exe	45
PID 2984 wrote to memory of 992	2984	cmd.exe	45
PID 2984 wrote to memory of 992	2984	cmd.exe	45
PID 2984 wrote to memory of 1120	2984	cmd.exe	46
PID 2984 wrote to memory of 1120	2984	cmd.exe	46
PID 2984 wrote to memory of 1120	2984	cmd.exe	46
PID 2984 wrote to memory of 1032	2984	cmd.exe	47
PID 2984 wrote to memory of 1032	2984	cmd.exe	47
PID 2984 wrote to memory of 1032	2984	cmd.exe	47
PID 1032 wrote to memory of 776	1032	Runtime Broker.exe	48
PID 1032 wrote to memory of 776	1032	Runtime Broker.exe	48
PID 1032 wrote to memory of 776	1032	Runtime Broker.exe	48
PID 1032 wrote to memory of 3060	1032	Runtime Broker.exe	50
PID 1032 wrote to memory of 3060	1032	Runtime Broker.exe	50
PID 1032 wrote to memory of 3060	1032	Runtime Broker.exe	50
PID 3060 wrote to memory of 1492	3060	cmd.exe	52
PID 3060 wrote to memory of 1492	3060	cmd.exe	52
PID 3060 wrote to memory of 1492	3060	cmd.exe	52
PID 3060 wrote to memory of 2548	3060	cmd.exe	53
PID 3060 wrote to memory of 2548	3060	cmd.exe	53
PID 3060 wrote to memory of 2548	3060	cmd.exe	53
PID 3060 wrote to memory of 2116	3060	cmd.exe	54
PID 3060 wrote to memory of 2116	3060	cmd.exe	54
PID 3060 wrote to memory of 2116	3060	cmd.exe	54
PID 2116 wrote to memory of 2084	2116	Runtime Broker.exe	55
PID 2116 wrote to memory of 2084	2116	Runtime Broker.exe	55
PID 2116 wrote to memory of 2084	2116	Runtime Broker.exe	55
PID 2116 wrote to memory of 920	2116	Runtime Broker.exe	57
PID 2116 wrote to memory of 920	2116	Runtime Broker.exe	57
PID 2116 wrote to memory of 920	2116	Runtime Broker.exe	57
PID 920 wrote to memory of 2264	920	cmd.exe	59
PID 920 wrote to memory of 2264	920	cmd.exe	59
PID 920 wrote to memory of 2264	920	cmd.exe	59
PID 920 wrote to memory of 2868	920	cmd.exe	60
PID 920 wrote to memory of 2868	920	cmd.exe	60
PID 920 wrote to memory of 2868	920	cmd.exe	60
PID 920 wrote to memory of 1884	920	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2464
- C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
  "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZKImFQzwueDF.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2832
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2624
  - - C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
      "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2380
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\uPsxHXjJk8wN.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2984
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:992
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1120
      - C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:776
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QXSIONensFMn.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1492
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2548
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2084
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PNkFjreDMiWv.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2264
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2868
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1884
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1332
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\wgovW7DeIhTH.bat" "
        11⤵
        
        PID:1776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:952
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2224
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:528
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\mifBq43G1hhr.bat" "
        13⤵
        
        PID:1504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1244
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:764
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1808
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:276
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\XPrkeN20mSrW.bat" "
        15⤵
        
        PID:2796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1736
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2624
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\McoVQpGKBadf.bat" "
        17⤵
        
        PID:2156
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1484
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\iDgbCHarjWSS.bat" "
        19⤵
        
        PID:796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1324
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1960
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1760
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1516
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\dOYQ8BN7d8wj.bat" "
        21⤵
        
        PID:448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2092
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1240
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:468
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\BOxIBer1OXVX.bat" "
        23⤵
        
        PID:1580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1684
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1056
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1728
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\WOkCBXoCAWWy.bat" "
        25⤵
        
        PID:1756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1040
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BOxIBer1OXVX.bat

Filesize
208B

MD5
9106e10132668f44da60f30a124682cf

SHA1
aa4f9363ce49e4ec4c7532ac6fa8ada7875d6a8f

SHA256
d41fccbbbb8947564eeb11a06474babed3f31606d68883212fe4c82e9a5ce507

SHA512
aaa6dfb180e275a04eaa1329e4bf565098f343261d38774be4c1d8054cb0e8ba5f782f3bbf6e1f56994f33a802b9feb2546e89c099522382a9dca4ad9a4e4b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\McoVQpGKBadf.bat

Filesize
208B

MD5
b72c2d6801645683afc38472765f842e

SHA1
6d4680eeece5401ba5c4545f04c58e48e411d61d

SHA256
3de89545489560c4192c7189e562deac007d1df85aa549d15262ade1e2982b82

SHA512
2e648b2f70c50c6d5343cfc6b44529ab36b81fed90dc8f34ad39308a47675994058dbe6cbaf3de096ceec1b4559e518391195065c8d7b2e48ddeb9a20732699c

Download Submit
C:\Users\Admin\AppData\Local\Temp\PNkFjreDMiWv.bat

Filesize
208B

MD5
7d14b9df6144de3364d6a002f326524b

SHA1
096b9730e30584aa4266af7ad6d0d096a068b123

SHA256
12baa17773c807a82c60eba7c04a9ac03dcb1e3f38c488f2f6056c9d729b517e

SHA512
1a016f9f543272a9d83eb3fe178a554fcac1995b376a83aff2e12381a2e575e4f5715a31c0dcb61071913011b4d46d2e748c7effe00b83c9f948683b6131e8ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\QXSIONensFMn.bat

Filesize
208B

MD5
3a7092520675526f6ec944ccbf46a149

SHA1
e7707ee4f15b2cf98c14ec960d5f2fe2642ea520

SHA256
368f46ea21f2c0e3462777a06cee323416a58a08aea833ce22e87a72be923df7

SHA512
2d4ab4bf678b445e24009dc8d39b49dfa65d4b8f86ceda772ea4ac4bbf04bf6604d67b6e3579f365614d04ef913d557dc5d69e7c28e816246efc45292263f9e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\WOkCBXoCAWWy.bat

Filesize
208B

MD5
7115cd813d0d2f6a0f3458d698728eda

SHA1
2f0f564389f7bc173bfcdc464a7e6c8f5777a0e7

SHA256
632a04426d35f67674e436557a431419081273f6f7efbf95397fffa10d3787c9

SHA512
14e889cc378086c03542cf98c0bfbf8161d659e491437d36f84af22e99a5643313df72615b3ef2515b204b5665093594bf83399830aeed6f9b63bdadac5c7d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\XPrkeN20mSrW.bat

Filesize
208B

MD5
11f1f317e4e84fccb241e680dbd26b45

SHA1
330b3fcb7ce680b079742d2c9d2e25d8527dcbb2

SHA256
c30aeb5f1ff2ec3a25770088a629780b5a09623ca73d54b46d10d5989f685c8f

SHA512
9e9c30d4aa8fe2cac2394ad2c005721641b7e76f29f8e2da597ab02d556ac52500f26b5326ec250947dfcccbd91411417dd914cac15bba85e2859bea76d677ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZKImFQzwueDF.bat

Filesize
208B

MD5
98d2a3b7d8ac81bf366ff1325ebc05f4

SHA1
34ba9b173a02ffae8eeddbf2a3b4efa9c5f63d73

SHA256
f5e2b5fd5deffc71391b445123e189ebb52aa4de1289aee283638370f6304a40

SHA512
092b4a2f413ab8195ca861084c863a7b20712c313f032daca5338bc8048d34af456695133f5a0ca7d8c2e1a57951b1bb05b85ef63d7afc752cd224a176a1bc18

Download Submit
C:\Users\Admin\AppData\Local\Temp\dOYQ8BN7d8wj.bat

Filesize
208B

MD5
33bd7321cad09307101f6e77f97370f8

SHA1
ddb96cb11f4a9a05f83d964b049ba1f330fe8919

SHA256
971417c666b0eb2ccdaa2c8297af1964b4b673fc689006bceee6192017ba68df

SHA512
de9620a48c38ae5782c38b57117b1c3daefce0fa455cffd522156f3c9f743f207b5634517e9c396e861717fa209a523236064393af474feb4283d2cddbc04913

Download Submit
C:\Users\Admin\AppData\Local\Temp\iDgbCHarjWSS.bat

Filesize
208B

MD5
509a89811d3f9a4c14963717a8581797

SHA1
b3cb73702d7e8918ce83f0a96b2b0f103a7f3cbc

SHA256
6bde41cd024c8b2396eda3ac1558a4022c394b3e5e9724707a890a9ad6369785

SHA512
6b2d39a40a005f9c8d3a2e630f9a657d85d4d704d30ee56f225057ef7741cff88e453966218353dc00d6d9f9d84715b21ee74ce7d00967cad92bc1efeaf3e5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mifBq43G1hhr.bat

Filesize
208B

MD5
bee17384ac670c34ab325c19129db819

SHA1
5d933f4cd323c02ac7d03d3bebb9012e2dba694c

SHA256
911c8d0832c919a3ed4eaba07851635c74b6628746beb4ce629311389f3051cb

SHA512
58a036ddab67ecc6cdf5dcf0ed018f50daeebe7c8b4f3355c02c086a66b83f9b46c5a3dc3d76763a63e72c72bf8fb6c4e0ee1ce6177d6374155c7b7db8bb5bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\uPsxHXjJk8wN.bat

Filesize
208B

MD5
c496f05a5f5d912d8b2f903dd27061c9

SHA1
ba8a21924a216991ca17cf3f256bfb90104b2b55

SHA256
110231ef6df3b2a45e8c9c346d0b074b1d5452f5ebe63d431e649b05a1b4a383

SHA512
7822b293d526b16167fcda481162804cd38757a0b9e10993fa8f99c3d07fa5a19cdfe10775b1a7e9a54dc7d7c31a9e2fb88e717d2e4790645294937fe5790b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wgovW7DeIhTH.bat

Filesize
208B

MD5
14fb275133594745fed9d087382ef1c5

SHA1
0ca4a0fefea7b9050e9bda9fbbc96f6790bd3565

SHA256
7f9a9a45e36724331acf8f3f2498c475ea7030ddc9e2198845efa3ecaf92ee8f

SHA512
90b2e7bc0c4c270a7aeb6387948d4c3536913b2b14223db8f55d7c4beaaf9eee7d021ce0954003fcc70555c2d6ac59918e43bdaec2e5e2986ee8379d3881b12d

Download Submit
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

Filesize
3.1MB

MD5
dd7a806c734df62ecf4802977fa0b3e9

SHA1
42eae42e0fcfe9d9a54e493a670adde5241377da

SHA256
cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f

SHA512
0f8e2e565b40baabdde4018db57e06aee8e8dfeb4b1491e8e02e56a20e6b55bc1130ed74a702c35e043d4886af969af5d8ca26f5caeb0e96694982ecfbc80bbf

Download Submit
memory/1736-0-0x000007FEF5483000-0x000007FEF5484000-memory.dmp

Filesize
4KB

Download
memory/1736-8-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/1736-2-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/1736-1-0x0000000000F50000-0x0000000001274000-memory.dmp

Filesize
3.1MB

Download
memory/1760-110-0x0000000000DA0000-0x00000000010C4000-memory.dmp

Filesize
3.1MB

Download
memory/1808-75-0x0000000000050000-0x0000000000374000-memory.dmp

Filesize
3.1MB

Download
memory/2264-121-0x0000000000F90000-0x00000000012B4000-memory.dmp

Filesize
3.1MB

Download
memory/2340-9-0x0000000001200000-0x0000000001524000-memory.dmp

Filesize
3.1MB

Download
memory/2340-20-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2340-11-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2340-10-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2596-98-0x0000000000AD0000-0x0000000000DF4000-memory.dmp

Filesize
3.1MB

Download
memory/2652-87-0x0000000000390000-0x00000000006B4000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads