quasar | cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe
Size

3.1MB
MD5

dd7a806c734df62ecf4802977fa0b3e9
SHA1

42eae42e0fcfe9d9a54e493a670adde5241377da
SHA256

cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f
SHA512

0f8e2e565b40baabdde4018db57e06aee8e8dfeb4b1491e8e02e56a20e6b55bc1130ed74a702c35e043d4886af969af5d8ca26f5caeb0e96694982ecfbc80bbf
SSDEEP

49152:yvkt62XlaSFNWPjljiFa2RoUYIO8RJ6IbR3LoGdaTHHB72eh2NT:yv462XlaSFNWPjljiFXRoUYIO8RJ6i

Score

10^/10

quasar aryszx discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Aryszx

Apichat:4782

Mutex

181f4a12-4cad-46a9-9896-1001033c5b69

Attributes

encryption_key
F4F359BEF442D9221F73F7D64267E0E300CC68CE
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
1
startup_key
Runtime Broker

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 10 IoCs

resource	yara_rule
behavioral1/memory/2488-1-0x00000000008A0000-0x0000000000BC4000-memory.dmp	family_quasar
behavioral1/files/0x0007000000012119-6.dat	family_quasar
behavioral1/memory/264-8-0x0000000000040000-0x0000000000364000-memory.dmp	family_quasar
behavioral1/memory/2708-23-0x0000000000EC0000-0x00000000011E4000-memory.dmp	family_quasar
behavioral1/memory/1976-34-0x0000000000150000-0x0000000000474000-memory.dmp	family_quasar
behavioral1/memory/1812-45-0x0000000000A60000-0x0000000000D84000-memory.dmp	family_quasar
behavioral1/memory/1928-56-0x0000000001290000-0x00000000015B4000-memory.dmp	family_quasar
behavioral1/memory/2588-98-0x0000000000280000-0x00000000005A4000-memory.dmp	family_quasar
behavioral1/memory/1964-109-0x0000000001030000-0x0000000001354000-memory.dmp	family_quasar
behavioral1/memory/2748-120-0x0000000001130000-0x0000000001454000-memory.dmp	family_quasar

Executes dropped EXE 12 IoCs

pid	Process
264	Runtime Broker.exe
2708	Runtime Broker.exe
1976	Runtime Broker.exe
1812	Runtime Broker.exe
1928	Runtime Broker.exe
1692	Runtime Broker.exe
2924	Runtime Broker.exe
2696	Runtime Broker.exe
2588	Runtime Broker.exe
1964	Runtime Broker.exe
2748	Runtime Broker.exe
1928	Runtime Broker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
560	PING.EXE
2836	PING.EXE
1412	PING.EXE
2436	PING.EXE
1372	PING.EXE
1724	PING.EXE
1656	PING.EXE
1904	PING.EXE
1268	PING.EXE
2240	PING.EXE
784	PING.EXE
2444	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
2836	PING.EXE
1412	PING.EXE
1904	PING.EXE
2444	PING.EXE
1372	PING.EXE
1724	PING.EXE
560	PING.EXE
1268	PING.EXE
2240	PING.EXE
784	PING.EXE
2436	PING.EXE
1656	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2532	schtasks.exe
2348	schtasks.exe
2596	schtasks.exe
1556	schtasks.exe
2472	schtasks.exe
2180	schtasks.exe
2752	schtasks.exe
2300	schtasks.exe
2440	schtasks.exe
1976	schtasks.exe
2740	schtasks.exe
2400	schtasks.exe
2072	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe
Token: SeDebugPrivilege	264	Runtime Broker.exe
Token: SeDebugPrivilege	2708	Runtime Broker.exe
Token: SeDebugPrivilege	1976	Runtime Broker.exe
Token: SeDebugPrivilege	1812	Runtime Broker.exe
Token: SeDebugPrivilege	1928	Runtime Broker.exe
Token: SeDebugPrivilege	1692	Runtime Broker.exe
Token: SeDebugPrivilege	2924	Runtime Broker.exe
Token: SeDebugPrivilege	2696	Runtime Broker.exe
Token: SeDebugPrivilege	2588	Runtime Broker.exe
Token: SeDebugPrivilege	1964	Runtime Broker.exe
Token: SeDebugPrivilege	2748	Runtime Broker.exe
Token: SeDebugPrivilege	1928	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
264	Runtime Broker.exe
2708	Runtime Broker.exe
1976	Runtime Broker.exe
1812	Runtime Broker.exe
1928	Runtime Broker.exe
1692	Runtime Broker.exe
2924	Runtime Broker.exe
2696	Runtime Broker.exe
2588	Runtime Broker.exe
1964	Runtime Broker.exe
2748	Runtime Broker.exe
1928	Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2072	2488	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	30
PID 2488 wrote to memory of 2072	2488	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	30
PID 2488 wrote to memory of 2072	2488	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	30
PID 2488 wrote to memory of 264	2488	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	32
PID 2488 wrote to memory of 264	2488	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	32
PID 2488 wrote to memory of 264	2488	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	32
PID 264 wrote to memory of 2752	264	Runtime Broker.exe	33
PID 264 wrote to memory of 2752	264	Runtime Broker.exe	33
PID 264 wrote to memory of 2752	264	Runtime Broker.exe	33
PID 264 wrote to memory of 2644	264	Runtime Broker.exe	36
PID 264 wrote to memory of 2644	264	Runtime Broker.exe	36
PID 264 wrote to memory of 2644	264	Runtime Broker.exe	36
PID 2644 wrote to memory of 2844	2644	cmd.exe	38
PID 2644 wrote to memory of 2844	2644	cmd.exe	38
PID 2644 wrote to memory of 2844	2644	cmd.exe	38
PID 2644 wrote to memory of 2836	2644	cmd.exe	39
PID 2644 wrote to memory of 2836	2644	cmd.exe	39
PID 2644 wrote to memory of 2836	2644	cmd.exe	39
PID 2644 wrote to memory of 2708	2644	cmd.exe	40
PID 2644 wrote to memory of 2708	2644	cmd.exe	40
PID 2644 wrote to memory of 2708	2644	cmd.exe	40
PID 2708 wrote to memory of 2532	2708	Runtime Broker.exe	41
PID 2708 wrote to memory of 2532	2708	Runtime Broker.exe	41
PID 2708 wrote to memory of 2532	2708	Runtime Broker.exe	41
PID 2708 wrote to memory of 2548	2708	Runtime Broker.exe	43
PID 2708 wrote to memory of 2548	2708	Runtime Broker.exe	43
PID 2708 wrote to memory of 2548	2708	Runtime Broker.exe	43
PID 2548 wrote to memory of 1624	2548	cmd.exe	45
PID 2548 wrote to memory of 1624	2548	cmd.exe	45
PID 2548 wrote to memory of 1624	2548	cmd.exe	45
PID 2548 wrote to memory of 1412	2548	cmd.exe	46
PID 2548 wrote to memory of 1412	2548	cmd.exe	46
PID 2548 wrote to memory of 1412	2548	cmd.exe	46
PID 2548 wrote to memory of 1976	2548	cmd.exe	47
PID 2548 wrote to memory of 1976	2548	cmd.exe	47
PID 2548 wrote to memory of 1976	2548	cmd.exe	47
PID 1976 wrote to memory of 2348	1976	Runtime Broker.exe	48
PID 1976 wrote to memory of 2348	1976	Runtime Broker.exe	48
PID 1976 wrote to memory of 2348	1976	Runtime Broker.exe	48
PID 1976 wrote to memory of 1704	1976	Runtime Broker.exe	50
PID 1976 wrote to memory of 1704	1976	Runtime Broker.exe	50
PID 1976 wrote to memory of 1704	1976	Runtime Broker.exe	50
PID 1704 wrote to memory of 1720	1704	cmd.exe	52
PID 1704 wrote to memory of 1720	1704	cmd.exe	52
PID 1704 wrote to memory of 1720	1704	cmd.exe	52
PID 1704 wrote to memory of 1904	1704	cmd.exe	53
PID 1704 wrote to memory of 1904	1704	cmd.exe	53
PID 1704 wrote to memory of 1904	1704	cmd.exe	53
PID 1704 wrote to memory of 1812	1704	cmd.exe	54
PID 1704 wrote to memory of 1812	1704	cmd.exe	54
PID 1704 wrote to memory of 1812	1704	cmd.exe	54
PID 1812 wrote to memory of 2596	1812	Runtime Broker.exe	55
PID 1812 wrote to memory of 2596	1812	Runtime Broker.exe	55
PID 1812 wrote to memory of 2596	1812	Runtime Broker.exe	55
PID 1812 wrote to memory of 2636	1812	Runtime Broker.exe	57
PID 1812 wrote to memory of 2636	1812	Runtime Broker.exe	57
PID 1812 wrote to memory of 2636	1812	Runtime Broker.exe	57
PID 2636 wrote to memory of 444	2636	cmd.exe	59
PID 2636 wrote to memory of 444	2636	cmd.exe	59
PID 2636 wrote to memory of 444	2636	cmd.exe	59
PID 2636 wrote to memory of 1268	2636	cmd.exe	60
PID 2636 wrote to memory of 1268	2636	cmd.exe	60
PID 2636 wrote to memory of 1268	2636	cmd.exe	60
PID 2636 wrote to memory of 1928	2636	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe
"C:\Users\Admin\AppData\Local\Temp\cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2072
- C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
  "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2752
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1TSvUeg4yeUR.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2844
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2836
  - - C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
      "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2532
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1iqhytH3Kt2o.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2548
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1624
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1412
      - C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2348
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\C9S6eBrk2XcF.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1904
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2596
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\G9f0e5OlX3MT.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:444
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1268
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1556
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gR5DHQRdpEBX.bat" "
        11⤵
        
        PID:2012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1552
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2240
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2300
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\evU1PuLRxKbK.bat" "
        13⤵
        
        PID:2008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:784
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2472
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Wqnbok2CPsPG.bat" "
        15⤵
        
        PID:2688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2436
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2440
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\XnP3hG3M6rMs.bat" "
        17⤵
        
        PID:2592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1584
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2444
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2180
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\VdtuvE5huO7V.bat" "
        19⤵
        
        PID:1640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2348
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1372
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1976
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AuUkjNvi0lWa.bat" "
        21⤵
        
        PID:2772
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1724
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2740
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LoLC1KjsUhHY.bat" "
        23⤵
        
        PID:1788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1656
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2400
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YPRDxbNQL3mE.bat" "
        25⤵
        
        PID:2248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2052
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1TSvUeg4yeUR.bat

Filesize
208B

MD5
58cea857a2d655a22baf422fbccd3ed8

SHA1
212f8494a3f3ce1895116e8c78a9ed9bc8086028

SHA256
871f70fca82d0fc4088f6b0d1f91ab4a0b37eb95c98d7e0de3493d63e3e16257

SHA512
3a25982fb792f8ce77e3bca2f2c50438fe7dda311939947562af58942e2a04b3a872398eec27a4bb12e8017574023e928a31dd01d74bd44d20a195379f52455f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1iqhytH3Kt2o.bat

Filesize
208B

MD5
90c28db29b2a44addfe2398a4c289fec

SHA1
11cfe37c91cd0d7b23b07b96242f2521a552b565

SHA256
ec1a4180d097fc2adbe02ac27a02faead27fcfe35bea29d380dc0ecef38fdc53

SHA512
a5ba66032890047a67a7027670b3954f39d78573565860ea3fa56c756948d17a093f97f21eff39948643aed0efb56c98d4749b311881284aedb1a02397259628

Download Submit
C:\Users\Admin\AppData\Local\Temp\AuUkjNvi0lWa.bat

Filesize
208B

MD5
0bd259621a603da49ed3247aa87449f0

SHA1
a367ec35e21e76a8f2bad6604503094b74d7d9fb

SHA256
a9460b7a03d262fba0a07a3633ca5b639b0b397ed31958295169cd3fdbdad45a

SHA512
6b9d403209bd5881044d52e16eb4d7263841a859a3a03190b2a7780155a96f20e977c3f08fa354379107fea94ef72cfe86340142ec2e5afa47ed24ace32c6dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\C9S6eBrk2XcF.bat

Filesize
208B

MD5
f9c759c92a0a208ba3b0e7cb18966a53

SHA1
e5f1b1a0e9958d201994d7026686f1c8ae38faa7

SHA256
1410506663ad1656e2363db68cb59870249255a4c4bb58741322a16fea950a50

SHA512
77e9ebb10899561357e20c5b1d751d7bafd8d30657282ef12c2676bb2288a873c1e5b7ea5bfbdf8bfa48223a73d0d11e230bc96a9d2ea91d5b29250f3e53ee19

Download Submit
C:\Users\Admin\AppData\Local\Temp\G9f0e5OlX3MT.bat

Filesize
208B

MD5
c2214aff4e658a8fb8b4791ef85de4a7

SHA1
5d4350481550cd2c396ce714c6e7ca1883faff44

SHA256
1dc7db5448da7b59edba2b00c50ab9c7081dbc07c2a10dffa52bce97c723ce5c

SHA512
9fa46338308593240debfd628f53b0091743997e6557f7a8e2f47df99b9396ac08fa87fea0d7d6df35232eaa2b607b10fa1dedc722e8fe88553891837ea71138

Download Submit
C:\Users\Admin\AppData\Local\Temp\LoLC1KjsUhHY.bat

Filesize
208B

MD5
90ffe5d344999857b7a03a9b549233f7

SHA1
1b50b44009524ee12527ffcc5a3b4e53f1a00189

SHA256
c8df60614bf381b9f46843ed773c984f6d4f9b86bd795720eec73f4ddc076d4a

SHA512
cbfbdf23039a544fed2e2fd4a97a3f5f685425e96e7d00560f2534f228d479bac786bcbc1ac2461379ac137a5122046898c3de955356cdd76c9eec886491c866

Download Submit
C:\Users\Admin\AppData\Local\Temp\VdtuvE5huO7V.bat

Filesize
208B

MD5
e54cfd40ea027d5b9dde9718805ab4b9

SHA1
e4d3d7da3bc886f6680bb2f01268cf30895ed46b

SHA256
de70d8c6095660e2f3fb1e70c20c79a4206318f38fc4d0cef255350865f7df6e

SHA512
8a5201e57e1c073a5d8b368663c8608e2cc358e9493d8a6da0ef6d536679a992aece7a3dda4fd0fb05e81ca276011b85003f68d49f2aed4a5214fe54b62923dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wqnbok2CPsPG.bat

Filesize
208B

MD5
b25338ab140a06b46bf968bcb30e7d80

SHA1
6088a01c0ac95cab4c494a236117ed99b57c647b

SHA256
0ce9ac0419f77faca2cd432a24ef077e19de63be49dbb0e35d25d7023662fd96

SHA512
118bcebcf2cbe2d8425852c18fbd400a10d63653c9eb52d2af1335ee821a224c6dd4c5f2f976e140381dd5c88e7b35e418df756cdbba8cc6eca0432a1ad7fbce

Download Submit
C:\Users\Admin\AppData\Local\Temp\XnP3hG3M6rMs.bat

Filesize
208B

MD5
6922f7829f73155ac5aede46e71aa4e6

SHA1
40c8d5d539c5be682234d674f94628e95185aa7b

SHA256
f4d9077ab837fc0e5da1a9a7376e41c002a82c5ed95e26c98088f3a8fb55b2d3

SHA512
89d9c9d7c6b6ea2081b6436f0dcfa0ae57f4d34b6689edae4f450b08e6a10d987473bd4e7a43c4e94a163280b0973e791da1de2c55d8f699b12de9ae1d219147

Download Submit
C:\Users\Admin\AppData\Local\Temp\YPRDxbNQL3mE.bat

Filesize
208B

MD5
73a4184a3c7fa32d04d686877371e3f0

SHA1
f0acb2e5985d12cf37d696748d752c93aecdb199

SHA256
6b582632dee4316377ee9ea0e007df02acf84e7d6ae05b2189d61be421670a40

SHA512
7edb2718c930ff719b376caa7e3b5084f5a83f5d5504251271039b85217db16f03a909d06a6dd6908c2ffa6d9cf09afd8daa68fef68b96a02ec514c51c67e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\evU1PuLRxKbK.bat

Filesize
208B

MD5
5d87541ccda6d759dd4fc9a7f0133f00

SHA1
6e9ea3012ae1c4507f3153f5e0053598156852a8

SHA256
86cd2a24c814d6e0cff6afd01d5f0db962797410f179c3f2e6842d29dac1e5fd

SHA512
64ac15548bd05a43bd51f2ab11a813410c78e37b89dc1c765894a626e36c7640cdd7acdf4a96192e5162a17db7cc35d24d8a430aa1c3e0379805c927d489eb9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gR5DHQRdpEBX.bat

Filesize
208B

MD5
57c456e33e34d63e62b16ee1021ddb09

SHA1
aad449862161b2e5d1929a19fda655180a5c81c3

SHA256
0580a99df691e6c78b771f66082ce9946703a9029a170ba9c9e51339d42c6dc6

SHA512
dc4867b6700096b374a9df8ddcb8eaaecd1cbe54c8cfedacfbbcca2f9aab58336a43634c93f208237623d9c113dc1d77fa3d815342ce6f0813bad501eba6e07b

Download Submit
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

Filesize
3.1MB

MD5
dd7a806c734df62ecf4802977fa0b3e9

SHA1
42eae42e0fcfe9d9a54e493a670adde5241377da

SHA256
cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f

SHA512
0f8e2e565b40baabdde4018db57e06aee8e8dfeb4b1491e8e02e56a20e6b55bc1130ed74a702c35e043d4886af969af5d8ca26f5caeb0e96694982ecfbc80bbf

Download Submit
memory/264-10-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/264-11-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/264-8-0x0000000000040000-0x0000000000364000-memory.dmp

Filesize
3.1MB

Download
memory/264-20-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-45-0x0000000000A60000-0x0000000000D84000-memory.dmp

Filesize
3.1MB

Download
memory/1928-56-0x0000000001290000-0x00000000015B4000-memory.dmp

Filesize
3.1MB

Download
memory/1964-109-0x0000000001030000-0x0000000001354000-memory.dmp

Filesize
3.1MB

Download
memory/1976-34-0x0000000000150000-0x0000000000474000-memory.dmp

Filesize
3.1MB

Download
memory/2488-0-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/2488-9-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-2-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-1-0x00000000008A0000-0x0000000000BC4000-memory.dmp

Filesize
3.1MB

Download
memory/2588-98-0x0000000000280000-0x00000000005A4000-memory.dmp

Filesize
3.1MB

Download
memory/2708-23-0x0000000000EC0000-0x00000000011E4000-memory.dmp

Filesize
3.1MB

Download
memory/2748-120-0x0000000001130000-0x0000000001454000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads