quasar | cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe
Size

3.1MB
MD5

dd7a806c734df62ecf4802977fa0b3e9
SHA1

42eae42e0fcfe9d9a54e493a670adde5241377da
SHA256

cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f
SHA512

0f8e2e565b40baabdde4018db57e06aee8e8dfeb4b1491e8e02e56a20e6b55bc1130ed74a702c35e043d4886af969af5d8ca26f5caeb0e96694982ecfbc80bbf
SSDEEP

49152:yvkt62XlaSFNWPjljiFa2RoUYIO8RJ6IbR3LoGdaTHHB72eh2NT:yv462XlaSFNWPjljiFXRoUYIO8RJ6i

Score

10^/10

quasar aryszx discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Aryszx

Apichat:4782

Mutex

181f4a12-4cad-46a9-9896-1001033c5b69

Attributes

encryption_key
F4F359BEF442D9221F73F7D64267E0E300CC68CE
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
1
startup_key
Runtime Broker

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 12 IoCs

resource	yara_rule
behavioral1/memory/2744-1-0x0000000001160000-0x0000000001484000-memory.dmp	family_quasar
behavioral1/files/0x0008000000012102-6.dat	family_quasar
behavioral1/memory/2820-9-0x0000000001330000-0x0000000001654000-memory.dmp	family_quasar
behavioral1/memory/2644-34-0x00000000013A0000-0x00000000016C4000-memory.dmp	family_quasar
behavioral1/memory/1884-45-0x00000000000C0000-0x00000000003E4000-memory.dmp	family_quasar
behavioral1/memory/1508-57-0x00000000003B0000-0x00000000006D4000-memory.dmp	family_quasar
behavioral1/memory/2268-68-0x0000000000160000-0x0000000000484000-memory.dmp	family_quasar
behavioral1/memory/3028-80-0x0000000000FE0000-0x0000000001304000-memory.dmp	family_quasar
behavioral1/memory/2832-101-0x00000000001A0000-0x00000000004C4000-memory.dmp	family_quasar
behavioral1/memory/2344-112-0x00000000012D0000-0x00000000015F4000-memory.dmp	family_quasar
behavioral1/memory/1324-123-0x00000000013D0000-0x00000000016F4000-memory.dmp	family_quasar
behavioral1/memory/940-134-0x0000000000040000-0x0000000000364000-memory.dmp	family_quasar

Executes dropped EXE 12 IoCs

pid	Process
2820	Runtime Broker.exe
1700	Runtime Broker.exe
2644	Runtime Broker.exe
1884	Runtime Broker.exe
1508	Runtime Broker.exe
2268	Runtime Broker.exe
3028	Runtime Broker.exe
648	Runtime Broker.exe
2832	Runtime Broker.exe
2344	Runtime Broker.exe
1324	Runtime Broker.exe
940	Runtime Broker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2848	PING.EXE
2208	PING.EXE
2228	PING.EXE
2192	PING.EXE
2608	PING.EXE
2972	PING.EXE
1704	PING.EXE
1468	PING.EXE
1260	PING.EXE
968	PING.EXE
1924	PING.EXE
2164	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
968	PING.EXE
1924	PING.EXE
2164	PING.EXE
2608	PING.EXE
2228	PING.EXE
1260	PING.EXE
2848	PING.EXE
2208	PING.EXE
2972	PING.EXE
1704	PING.EXE
1468	PING.EXE
2192	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1632	schtasks.exe
900	schtasks.exe
1212	schtasks.exe
1740	schtasks.exe
1260	schtasks.exe
2728	schtasks.exe
112	schtasks.exe
2700	schtasks.exe
2264	schtasks.exe
2916	schtasks.exe
2392	schtasks.exe
968	schtasks.exe
392	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe
Token: SeDebugPrivilege	2820	Runtime Broker.exe
Token: SeDebugPrivilege	1700	Runtime Broker.exe
Token: SeDebugPrivilege	2644	Runtime Broker.exe
Token: SeDebugPrivilege	1884	Runtime Broker.exe
Token: SeDebugPrivilege	1508	Runtime Broker.exe
Token: SeDebugPrivilege	2268	Runtime Broker.exe
Token: SeDebugPrivilege	3028	Runtime Broker.exe
Token: SeDebugPrivilege	648	Runtime Broker.exe
Token: SeDebugPrivilege	2832	Runtime Broker.exe
Token: SeDebugPrivilege	2344	Runtime Broker.exe
Token: SeDebugPrivilege	1324	Runtime Broker.exe
Token: SeDebugPrivilege	940	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2820	Runtime Broker.exe
1700	Runtime Broker.exe
2644	Runtime Broker.exe
1884	Runtime Broker.exe
1508	Runtime Broker.exe
2268	Runtime Broker.exe
3028	Runtime Broker.exe
648	Runtime Broker.exe
2832	Runtime Broker.exe
2344	Runtime Broker.exe
1324	Runtime Broker.exe
940	Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2700	2744	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	31
PID 2744 wrote to memory of 2700	2744	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	31
PID 2744 wrote to memory of 2700	2744	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	31
PID 2744 wrote to memory of 2820	2744	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	33
PID 2744 wrote to memory of 2820	2744	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	33
PID 2744 wrote to memory of 2820	2744	cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe	33
PID 2820 wrote to memory of 1632	2820	Runtime Broker.exe	34
PID 2820 wrote to memory of 1632	2820	Runtime Broker.exe	34
PID 2820 wrote to memory of 1632	2820	Runtime Broker.exe	34
PID 2820 wrote to memory of 2272	2820	Runtime Broker.exe	36
PID 2820 wrote to memory of 2272	2820	Runtime Broker.exe	36
PID 2820 wrote to memory of 2272	2820	Runtime Broker.exe	36
PID 2272 wrote to memory of 1048	2272	cmd.exe	38
PID 2272 wrote to memory of 1048	2272	cmd.exe	38
PID 2272 wrote to memory of 1048	2272	cmd.exe	38
PID 2272 wrote to memory of 1260	2272	cmd.exe	39
PID 2272 wrote to memory of 1260	2272	cmd.exe	39
PID 2272 wrote to memory of 1260	2272	cmd.exe	39
PID 2272 wrote to memory of 1700	2272	cmd.exe	40
PID 2272 wrote to memory of 1700	2272	cmd.exe	40
PID 2272 wrote to memory of 1700	2272	cmd.exe	40
PID 1700 wrote to memory of 2264	1700	Runtime Broker.exe	41
PID 1700 wrote to memory of 2264	1700	Runtime Broker.exe	41
PID 1700 wrote to memory of 2264	1700	Runtime Broker.exe	41
PID 1700 wrote to memory of 3000	1700	Runtime Broker.exe	43
PID 1700 wrote to memory of 3000	1700	Runtime Broker.exe	43
PID 1700 wrote to memory of 3000	1700	Runtime Broker.exe	43
PID 3000 wrote to memory of 528	3000	cmd.exe	45
PID 3000 wrote to memory of 528	3000	cmd.exe	45
PID 3000 wrote to memory of 528	3000	cmd.exe	45
PID 3000 wrote to memory of 2848	3000	cmd.exe	46
PID 3000 wrote to memory of 2848	3000	cmd.exe	46
PID 3000 wrote to memory of 2848	3000	cmd.exe	46
PID 3000 wrote to memory of 2644	3000	cmd.exe	47
PID 3000 wrote to memory of 2644	3000	cmd.exe	47
PID 3000 wrote to memory of 2644	3000	cmd.exe	47
PID 2644 wrote to memory of 2916	2644	Runtime Broker.exe	48
PID 2644 wrote to memory of 2916	2644	Runtime Broker.exe	48
PID 2644 wrote to memory of 2916	2644	Runtime Broker.exe	48
PID 2644 wrote to memory of 544	2644	Runtime Broker.exe	50
PID 2644 wrote to memory of 544	2644	Runtime Broker.exe	50
PID 2644 wrote to memory of 544	2644	Runtime Broker.exe	50
PID 544 wrote to memory of 2360	544	cmd.exe	52
PID 544 wrote to memory of 2360	544	cmd.exe	52
PID 544 wrote to memory of 2360	544	cmd.exe	52
PID 544 wrote to memory of 2208	544	cmd.exe	53
PID 544 wrote to memory of 2208	544	cmd.exe	53
PID 544 wrote to memory of 2208	544	cmd.exe	53
PID 544 wrote to memory of 1884	544	cmd.exe	54
PID 544 wrote to memory of 1884	544	cmd.exe	54
PID 544 wrote to memory of 1884	544	cmd.exe	54
PID 1884 wrote to memory of 2392	1884	Runtime Broker.exe	55
PID 1884 wrote to memory of 2392	1884	Runtime Broker.exe	55
PID 1884 wrote to memory of 2392	1884	Runtime Broker.exe	55
PID 1884 wrote to memory of 2044	1884	Runtime Broker.exe	57
PID 1884 wrote to memory of 2044	1884	Runtime Broker.exe	57
PID 1884 wrote to memory of 2044	1884	Runtime Broker.exe	57
PID 2044 wrote to memory of 1932	2044	cmd.exe	59
PID 2044 wrote to memory of 1932	2044	cmd.exe	59
PID 2044 wrote to memory of 1932	2044	cmd.exe	59
PID 2044 wrote to memory of 968	2044	cmd.exe	60
PID 2044 wrote to memory of 968	2044	cmd.exe	60
PID 2044 wrote to memory of 968	2044	cmd.exe	60
PID 2044 wrote to memory of 1508	2044	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe
"C:\Users\Admin\AppData\Local\Temp\cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2700
- C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
  "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1632
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\cxWWrtM9CK8V.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1048
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1260
  - - C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
      "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2264
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\2wTY0W9GOUZW.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3000
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:528
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2848
      - C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2916
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MWS0xB8fXebF.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2360
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2208
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2392
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\s4IE3jQydQWQ.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:968
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:900
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\d6SXSmIki6lu.bat" "
        11⤵
        
        PID:2484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1924
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2268
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1212
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QhnCyeL61hyF.bat" "
        13⤵
        
        PID:1912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3068
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2164
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3028
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1740
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\B34wqPT8nYsn.bat" "
        15⤵
        
        PID:1492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2588
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2608
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:648
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1260
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\EwHvn1u5BVYd.bat" "
        17⤵
        
        PID:700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1664
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2228
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2728
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Nd0hmJDcy6Vi.bat" "
        19⤵
        
        PID:352
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2852
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2972
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2344
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:112
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CdhORpUSng8O.bat" "
        21⤵
        
        PID:1140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2404
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1704
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:968
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\iiYUiSOaL9or.bat" "
        23⤵
        
        PID:1760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2380
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1468
        
        C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:940
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:392
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JQ2QPh9vyKXv.bat" "
        25⤵
        
        PID:1968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2496
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2wTY0W9GOUZW.bat

Filesize
208B

MD5
b03342bdf37299d3b00e250465a368ca

SHA1
84812be9e00012129729211347a5f3a67473047d

SHA256
4858fb7f7c56534e3392d3845712e974a0f754aae1befad35b8856e19a8e1f64

SHA512
9bd3ef94cebd54935158c335fd3ff821045b8e3de8cf7770e97807a74d21e71be1f9a068c1b3f12fae8f703bf4ebefbcc528f23d3ca577607b355cd16493483a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B34wqPT8nYsn.bat

Filesize
208B

MD5
d6e65dfebbee2bf00900cf05c3a15427

SHA1
82d6dd0dd9a8576af8d9628ac626aa078eaa48bb

SHA256
dbdaf75623412dc92577a3096cde0fabee3f7e41dbe3572caf7c238fa0be3b45

SHA512
edc5a574209bc39306c0150b32c19112e34f6e7dcf11d0fafc7d2590979faa0b02e1b0b8f848c9a5a12228c359d9463b1c9367c571deb0e0ca9dec37df941b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\CdhORpUSng8O.bat

Filesize
208B

MD5
ecc910f1ea9b65b115a9af15b8eab903

SHA1
b344773bc9b12aa9003f6df37fa9dc3de5e08920

SHA256
0e535d58817e1592884b773ed59a853205ab4b78e29b9e5a27e6dffed2d5f939

SHA512
dc5a54d0344fb61d6d508ca3b061c881a27ed54760cde51e98f605002f0e96e229efa9235cfca526af8495cac5e553663bbfa2ea8aa26d7b0b54aa1fae5b9b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\EwHvn1u5BVYd.bat

Filesize
208B

MD5
057ac1a0612e3b8af0d0947120910b37

SHA1
32893da47f1c419ff70c1a69055c0cd130476555

SHA256
97769ead7e5bfddcb2eba4a93c3b6ca7dfc620c07ffaa7fc733ae902767b466f

SHA512
cf08990c5f0e17f10742a0daca30788d06abc0da5fb3756b6e7346320a50572d36e97bdcf8f367ae7f6e1024151a3d92459fc9bd9fc6ba14a63ddd3959fc2e2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\JQ2QPh9vyKXv.bat

Filesize
208B

MD5
78165fa31f92b63a1fc684847e65c48b

SHA1
f2779a8a06c3a99f896c232dd01c45f933f8a3ca

SHA256
e3b38470790c766a0a48300fe50766bb6fd4b433fc2e267cdb367a4319efde6b

SHA512
b5e1082d22d4b6e17512d8dca1ac46d27bb2cc1e50dbd4270e62b686cc212441fe009166319b5aabf78382f4ccb8ff9bf5cc7262a4d391cadbc02857b5b78ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MWS0xB8fXebF.bat

Filesize
208B

MD5
9ceecce58069596f2d37674ede34dbd8

SHA1
2d325536ea411a3516db60e283825c287813eee7

SHA256
d176bfa57736e177add349765accdbccf2213d5a59afa7ef4b5299e15522966a

SHA512
e6ade993a9e212d26ba44e852423eadff031204ca39c572526b9bdae3e1b9661114233cd727a1a61f887570b3d566c538e2ffa2fd825d5098d452665a081defe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nd0hmJDcy6Vi.bat

Filesize
208B

MD5
de540f22fa70ee25308e351de6c10912

SHA1
055a75d17015ecfdefb7327669595a8b2ae198c9

SHA256
2ea7f957adfee1da2148461647ffe4578e6f1f89180075acbf0109d80a86450d

SHA512
63a7eac51753eeb4735e1e3971d3809a9ae06a36751014fa01f056b0287be2af5b766ee352188537828538008001db1c43a9f68c99ab8407c94dd9c0c0022043

Download Submit
C:\Users\Admin\AppData\Local\Temp\QhnCyeL61hyF.bat

Filesize
208B

MD5
c6154ca0f1edf518e72148e3425f4408

SHA1
1e048c7bc2ba815608a69634a426b3c214fe5aba

SHA256
06ed116f85fc295204705e2c6da3a5e94135ea5d92d547ad417c81195e23422b

SHA512
7ca7a7bbd24e3758b640135890b26502b6e5c1855e6f83ebb139fe38658e28375d52e3df49e98aacafea35920964d7f76d6b4e91bff3ae3646f5712340884190

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxWWrtM9CK8V.bat

Filesize
208B

MD5
8c5414a80b4a2a67e7e6f865efe6feae

SHA1
d28e2a526686385a90228174257f9366d533ce30

SHA256
6313bef14f7661d5c762f608cc99ff7c1931c9ae124e51b9969cb9fd20699cf1

SHA512
b70fe4cbadb0ffc53e3622e76ae0b869d9c8c109e4131ffbc12db1cdef6bce55734d995ab41f66d0098722c3940bd785a901566fe6f6e8af4bc5b343f73914bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\d6SXSmIki6lu.bat

Filesize
208B

MD5
56c3160aa59381aa984f6db818148746

SHA1
8653431baff4e5480bf18652040d97a865829584

SHA256
23ec07d3bce04445cb5935ec2eeb2400d41eaefd7cd9ef0b98317a0b8ddae692

SHA512
c417879977be0b2be48dce048a73b6c1110edde30cd7ff170ce93e6b2e637a8b9ddd609cef2b7ed441e133e0959948bef0ad1bba3e9584bb2b4bff13128110b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iiYUiSOaL9or.bat

Filesize
208B

MD5
7aaa213f7e28cc11660e3af7cf8a8e75

SHA1
07b398c75bb23674adbeb9f9596e0c845e3e7e0b

SHA256
321599994437adbe86656d9bf19b3c5376ad3c414f52e48b1f8d564ce6ef60bf

SHA512
b02f14631c3003badd53f23f239922c14225f987f7c276b53372e5a0c3668d0fb949a0f059ef393909ea8d274568b9fa78f8ad73bac6a60dc7aeada42929d8eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\s4IE3jQydQWQ.bat

Filesize
208B

MD5
faf8e7b39fad643952b3f776544ca838

SHA1
b7e2849399139b0757f028407a8856104c250eb3

SHA256
860340e86ccccb121313f3bf8721755738d6f6dd23796886e8113aab1f3ab08f

SHA512
ed00bc19ba69f52569a4dd1c5eba44cc2448596bd39bdb9fa6ad3bde44b678d96ca8dcafeb469a4535b23c22bc37bd994f6735100afdf55fc751f87462c0655b

Download Submit
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

Filesize
3.1MB

MD5
dd7a806c734df62ecf4802977fa0b3e9

SHA1
42eae42e0fcfe9d9a54e493a670adde5241377da

SHA256
cca1725d99ffece2b6c33414d35f12079a32f6c86feed3c25e73065844f00c9f

SHA512
0f8e2e565b40baabdde4018db57e06aee8e8dfeb4b1491e8e02e56a20e6b55bc1130ed74a702c35e043d4886af969af5d8ca26f5caeb0e96694982ecfbc80bbf

Download Submit
memory/940-134-0x0000000000040000-0x0000000000364000-memory.dmp

Filesize
3.1MB

Download
memory/1324-123-0x00000000013D0000-0x00000000016F4000-memory.dmp

Filesize
3.1MB

Download
memory/1508-57-0x00000000003B0000-0x00000000006D4000-memory.dmp

Filesize
3.1MB

Download
memory/1884-45-0x00000000000C0000-0x00000000003E4000-memory.dmp

Filesize
3.1MB

Download
memory/2268-68-0x0000000000160000-0x0000000000484000-memory.dmp

Filesize
3.1MB

Download
memory/2344-112-0x00000000012D0000-0x00000000015F4000-memory.dmp

Filesize
3.1MB

Download
memory/2644-34-0x00000000013A0000-0x00000000016C4000-memory.dmp

Filesize
3.1MB

Download
memory/2744-0-0x000007FEF61F3000-0x000007FEF61F4000-memory.dmp

Filesize
4KB

Download
memory/2744-1-0x0000000001160000-0x0000000001484000-memory.dmp

Filesize
3.1MB

Download
memory/2744-2-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2744-8-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2820-11-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2820-9-0x0000000001330000-0x0000000001654000-memory.dmp

Filesize
3.1MB

Download
memory/2820-10-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2820-20-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2832-101-0x00000000001A0000-0x00000000004C4000-memory.dmp

Filesize
3.1MB

Download
memory/3028-80-0x0000000000FE0000-0x0000000001304000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads