quasar | e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf

Analysis

max time kernel
143s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe
Size

3.1MB
MD5

82761cf21801c5a88775b5b82bce7dcd
SHA1

8e4bb300478b689915d241a18b8a9da5ba21b2b9
SHA256

e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf
SHA512

2c45966635f2cc9bc53af8bb9070c4bd3f7d403f81fc40f58c0a0f2b04bfcd0a150092ae7a78971a9596ae0499cff98df0748eae8caacfabdfd522141b967425
SSDEEP

98304:bvNL26AaNeWgPhlmVqkQ7XSK46lRJ6jzr:Tb4SY2

Score

10^/10

quasar runtimebroker discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

dovefey735-52034.portmap.host:52034

Mutex

c1457435-328d-4da4-8379-23c8e51865c6

Attributes

encryption_key
BEDD596FBA59B01D6913DA83A0452739FD858DE1
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
a7

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral1/memory/1976-9-0x0000000000160000-0x0000000000484000-memory.dmp	family_quasar
behavioral1/files/0x000800000001932a-7.dat	family_quasar
behavioral1/memory/1684-1-0x0000000000070000-0x0000000000394000-memory.dmp	family_quasar
behavioral1/memory/2904-23-0x0000000001130000-0x0000000001454000-memory.dmp	family_quasar
behavioral1/memory/2876-86-0x00000000012F0000-0x0000000001614000-memory.dmp	family_quasar
behavioral1/memory/2380-97-0x00000000001C0000-0x00000000004E4000-memory.dmp	family_quasar
behavioral1/memory/1156-108-0x00000000012E0000-0x0000000001604000-memory.dmp	family_quasar
behavioral1/memory/2652-129-0x00000000013D0000-0x00000000016F4000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
1976	RuntimeBroker.exe
2904	RuntimeBroker.exe
2940	RuntimeBroker.exe
2500	RuntimeBroker.exe
1124	RuntimeBroker.exe
892	RuntimeBroker.exe
864	RuntimeBroker.exe
2876	RuntimeBroker.exe
2380	RuntimeBroker.exe
1156	RuntimeBroker.exe
2592	RuntimeBroker.exe
2652	RuntimeBroker.exe
2580	RuntimeBroker.exe
1988	RuntimeBroker.exe
2804	RuntimeBroker.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File created	C:\Windows\system32\a7\RuntimeBroker.exe	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2508	PING.EXE
1804	PING.EXE
1852	PING.EXE
2200	PING.EXE
3004	PING.EXE
2400	PING.EXE
2612	PING.EXE
1232	PING.EXE
2152	PING.EXE
2888	PING.EXE
2068	PING.EXE
2124	PING.EXE
1836	PING.EXE
1648	PING.EXE
1032	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1804	PING.EXE
2152	PING.EXE
3004	PING.EXE
2888	PING.EXE
1836	PING.EXE
2200	PING.EXE
1232	PING.EXE
2508	PING.EXE
2068	PING.EXE
2124	PING.EXE
1852	PING.EXE
2612	PING.EXE
1648	PING.EXE
1032	PING.EXE
2400	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2892	schtasks.exe
2848	schtasks.exe
2128	schtasks.exe
1904	schtasks.exe
2672	schtasks.exe
1972	schtasks.exe
1996	schtasks.exe
2496	schtasks.exe
2120	schtasks.exe
2576	schtasks.exe
2436	schtasks.exe
2016	schtasks.exe
3016	schtasks.exe
1904	schtasks.exe
980	schtasks.exe
748	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe
Token: SeDebugPrivilege	1976	RuntimeBroker.exe
Token: SeDebugPrivilege	2904	RuntimeBroker.exe
Token: SeDebugPrivilege	2940	RuntimeBroker.exe
Token: SeDebugPrivilege	2500	RuntimeBroker.exe
Token: SeDebugPrivilege	1124	RuntimeBroker.exe
Token: SeDebugPrivilege	892	RuntimeBroker.exe
Token: SeDebugPrivilege	864	RuntimeBroker.exe
Token: SeDebugPrivilege	2876	RuntimeBroker.exe
Token: SeDebugPrivilege	2380	RuntimeBroker.exe
Token: SeDebugPrivilege	1156	RuntimeBroker.exe
Token: SeDebugPrivilege	2592	RuntimeBroker.exe
Token: SeDebugPrivilege	2652	RuntimeBroker.exe
Token: SeDebugPrivilege	2580	RuntimeBroker.exe
Token: SeDebugPrivilege	1988	RuntimeBroker.exe
Token: SeDebugPrivilege	2804	RuntimeBroker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2016	1684	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe	30
PID 1684 wrote to memory of 2016	1684	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe	30
PID 1684 wrote to memory of 2016	1684	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe	30
PID 1684 wrote to memory of 1976	1684	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe	32
PID 1684 wrote to memory of 1976	1684	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe	32
PID 1684 wrote to memory of 1976	1684	e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe	32
PID 1976 wrote to memory of 2436	1976	RuntimeBroker.exe	33
PID 1976 wrote to memory of 2436	1976	RuntimeBroker.exe	33
PID 1976 wrote to memory of 2436	1976	RuntimeBroker.exe	33
PID 1976 wrote to memory of 2888	1976	RuntimeBroker.exe	35
PID 1976 wrote to memory of 2888	1976	RuntimeBroker.exe	35
PID 1976 wrote to memory of 2888	1976	RuntimeBroker.exe	35
PID 2888 wrote to memory of 2820	2888	cmd.exe	37
PID 2888 wrote to memory of 2820	2888	cmd.exe	37
PID 2888 wrote to memory of 2820	2888	cmd.exe	37
PID 2888 wrote to memory of 2152	2888	cmd.exe	38
PID 2888 wrote to memory of 2152	2888	cmd.exe	38
PID 2888 wrote to memory of 2152	2888	cmd.exe	38
PID 2888 wrote to memory of 2904	2888	cmd.exe	40
PID 2888 wrote to memory of 2904	2888	cmd.exe	40
PID 2888 wrote to memory of 2904	2888	cmd.exe	40
PID 2904 wrote to memory of 2672	2904	RuntimeBroker.exe	41
PID 2904 wrote to memory of 2672	2904	RuntimeBroker.exe	41
PID 2904 wrote to memory of 2672	2904	RuntimeBroker.exe	41
PID 2904 wrote to memory of 1828	2904	RuntimeBroker.exe	43
PID 2904 wrote to memory of 1828	2904	RuntimeBroker.exe	43
PID 2904 wrote to memory of 1828	2904	RuntimeBroker.exe	43
PID 1828 wrote to memory of 3044	1828	cmd.exe	45
PID 1828 wrote to memory of 3044	1828	cmd.exe	45
PID 1828 wrote to memory of 3044	1828	cmd.exe	45
PID 1828 wrote to memory of 3004	1828	cmd.exe	46
PID 1828 wrote to memory of 3004	1828	cmd.exe	46
PID 1828 wrote to memory of 3004	1828	cmd.exe	46
PID 1828 wrote to memory of 2940	1828	cmd.exe	47
PID 1828 wrote to memory of 2940	1828	cmd.exe	47
PID 1828 wrote to memory of 2940	1828	cmd.exe	47
PID 2940 wrote to memory of 3016	2940	RuntimeBroker.exe	48
PID 2940 wrote to memory of 3016	2940	RuntimeBroker.exe	48
PID 2940 wrote to memory of 3016	2940	RuntimeBroker.exe	48
PID 2940 wrote to memory of 1696	2940	RuntimeBroker.exe	50
PID 2940 wrote to memory of 1696	2940	RuntimeBroker.exe	50
PID 2940 wrote to memory of 1696	2940	RuntimeBroker.exe	50
PID 1696 wrote to memory of 564	1696	cmd.exe	52
PID 1696 wrote to memory of 564	1696	cmd.exe	52
PID 1696 wrote to memory of 564	1696	cmd.exe	52
PID 1696 wrote to memory of 2508	1696	cmd.exe	53
PID 1696 wrote to memory of 2508	1696	cmd.exe	53
PID 1696 wrote to memory of 2508	1696	cmd.exe	53
PID 1696 wrote to memory of 2500	1696	cmd.exe	54
PID 1696 wrote to memory of 2500	1696	cmd.exe	54
PID 1696 wrote to memory of 2500	1696	cmd.exe	54
PID 2500 wrote to memory of 2496	2500	RuntimeBroker.exe	55
PID 2500 wrote to memory of 2496	2500	RuntimeBroker.exe	55
PID 2500 wrote to memory of 2496	2500	RuntimeBroker.exe	55
PID 2500 wrote to memory of 2012	2500	RuntimeBroker.exe	57
PID 2500 wrote to memory of 2012	2500	RuntimeBroker.exe	57
PID 2500 wrote to memory of 2012	2500	RuntimeBroker.exe	57
PID 2012 wrote to memory of 1472	2012	cmd.exe	59
PID 2012 wrote to memory of 1472	2012	cmd.exe	59
PID 2012 wrote to memory of 1472	2012	cmd.exe	59
PID 2012 wrote to memory of 1836	2012	cmd.exe	60
PID 2012 wrote to memory of 1836	2012	cmd.exe	60
PID 2012 wrote to memory of 1836	2012	cmd.exe	60
PID 2012 wrote to memory of 1124	2012	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe
"C:\Users\Admin\AppData\Local\Temp\e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2016
- C:\Windows\system32\a7\RuntimeBroker.exe
  "C:\Windows\system32\a7\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2436
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\LnMRM6ROacFN.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2820
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2152
  - - C:\Windows\system32\a7\RuntimeBroker.exe
      "C:\Windows\system32\a7\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2672
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OiCmEUrdqMMK.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1828
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3044
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3004
      - C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3016
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10C7xNCbsJNx.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:564
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2508
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2496
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\hVE578NFXsEc.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1472
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1836
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2120
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Rf1UQnBjbn6z.bat" "
        11⤵
        
        PID:976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2564
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1648
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2892
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\GRj5ELXhpeOI.bat" "
        13⤵
        
        PID:320
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1868
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1032
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1972
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\eJ5KfswpHWaJ.bat" "
        15⤵
        
        PID:1220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:300
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2400
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1904
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1THaJI6BJyOH.bat" "
        17⤵
        
        PID:3000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2872
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2888
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2848
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1BkSwAPCSTq7.bat" "
        19⤵
        
        PID:2704
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2068
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:980
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MYTxE1KpdOHR.bat" "
        21⤵
        
        PID:1184
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2504
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1804
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2576
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\oXLlZ0ZvqGoW.bat" "
        23⤵
        
        PID:1472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:448
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1852
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1996
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6ahlWGggybEh.bat" "
        25⤵
        
        PID:1760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:692
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2612
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:748
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ixp7aDsdNilZ.bat" "
        27⤵
        
        PID:2996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:288
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2200
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2128
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\2H7z8u44iOOb.bat" "
        29⤵
        
        PID:2056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:688
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1232
        
        C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1904
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\8wuJAbfkTFwE.bat" "
        31⤵
        
        PID:2368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\10C7xNCbsJNx.bat

Filesize
199B

MD5
de4068489dc11be734f8112ea556de2e

SHA1
fde9dcee1cf62fb8a8890eb2496c4d622a328da0

SHA256
9445b497206861a685708a57750de179e5c7088348538203aecb7bb935ef147d

SHA512
91afc1613413a670e9258e388d10a83e7a97542dd31b260411705a72826cfe793ec0db2bf5da84dfb98952af838f2475a75d908588b45b7180b90dff910c4c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1BkSwAPCSTq7.bat

Filesize
199B

MD5
e7f052bc86ff4cb8f061a511663e137d

SHA1
31486a6ad0b375e7dd9779bd3be5839ab4c79a67

SHA256
40ab9aeb806efa8c31291daf8e78becaa05194b5f6f40a9fdf8198d3ec928472

SHA512
03aaff7e8c4abfbf836876224b6bfa55ae830315afc915a81f5e468d5946cc758199c751715b3060c3716205c70065391ba2d606a630b3e2ed396feec9237953

Download Submit
C:\Users\Admin\AppData\Local\Temp\1THaJI6BJyOH.bat

Filesize
199B

MD5
f5fd40fbda148c93de7c07732b192698

SHA1
d6005bd5a64df90dca706c22d442d1ba4ee42320

SHA256
cb7ca081812860ed49efc16af5029cbe72565d52afa196a1f6fda16356ebbf83

SHA512
4297335efaf745a8242508c85f2159f81ffa43e543ef5f863d0000851957af5303d205e32c345c25004f994e83ba45c9a83635f74aca301f1074ffdc4f18f20d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2H7z8u44iOOb.bat

Filesize
199B

MD5
0366a652b3268d75bb9cec43ed846cfc

SHA1
6629e4172a835fc58e37cbdd86ae9ab3b7b5518a

SHA256
f3b2b3650dff2c8feee0fde21a21b32507aec536e84cbfeae46a4cd83043d8f7

SHA512
e1a737043b8f395dbd555f44aadfe803f850e59eac3cbc1fff31063710e0afd8c5dc851c98ade98dcf07882ecc8981155a816c9a3f833e5b97fcb622e6d58d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ahlWGggybEh.bat

Filesize
199B

MD5
25699724e5dfc1c06b5c9460ebed4c46

SHA1
d8242b6ed60518cdf23c424d7c52952b5504988a

SHA256
4990e4f917a769be30d673d8622b5def4ea385c7aabec0b239f0da7f81924361

SHA512
883a38d4adb877caad73c7a4b7a8aad09689240b19e114e0884152d202716e785f1e156d161a95a675a3a78d25d0a4a24118b9e97bae752092745934c0417f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\8wuJAbfkTFwE.bat

Filesize
199B

MD5
ae5759c5ef9ef2bd554eacf55cd9df63

SHA1
3efc6c160ecd3a09d845f00dfdd87a242760e374

SHA256
713f65d0d83a26e32dde8c5589983358b957f98ea7f10d700ace0ab6d82e24aa

SHA512
b57a2b40c9a08f89df6c4d321cc8de6692663843e6b67e5b869508248f4b5d8dd0d6463b24d08742faa8c516b66c9e4ee413e503a9b2657c79dfbcee76367db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\GRj5ELXhpeOI.bat

Filesize
199B

MD5
4bae219a4162d98cbb9bf83ce7de5e9d

SHA1
b52be30ffec32e344acd1285d2d2e56472785a84

SHA256
62f18b547a21aa7533e8249dc4899416f6e3ab1cbe509d5bf4131d6088dae84a

SHA512
28ce2e5d56585e2956502a2fcdfd2c168abf9bdf8d249a7100b7f55ca4f3a7832efbe3150134ec8e4bfee32b8e71d079df8a1c1ce3281bae9ab29ee2759ac4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\LnMRM6ROacFN.bat

Filesize
199B

MD5
8775158624f829634f4a3690c9c4a89f

SHA1
db65a1b9a9446a996ca8d58f8d660627bec7195f

SHA256
e97da11221920481cefbd98f3eeff188f046be5697f693936990c3edcbe325a0

SHA512
3583869c717d063e91c425a95d18d48b74e5c5b5562fca6bdae0056f1ece0d0dd188d224842f370ee5976d78e8355e1d02ad9405e60383657ecaf947337b2233

Download Submit
C:\Users\Admin\AppData\Local\Temp\MYTxE1KpdOHR.bat

Filesize
199B

MD5
9d2d43c9aa8e046faead7384d7be95ac

SHA1
0088507f6bb55250e383dc7b773289d5a7278dbf

SHA256
43b90d6d51f46194f62df9cbb01c513091b7e10cf4885e583282eaa3416fc8ce

SHA512
b0f8c6a8aea6c565c9b47de41894911a1c9d38e1b264bc482ef38f3c83c7294c13f503cb0ed5d8faa8727c455bd07c343d86e8c45a0e34f1495f7f9d036d8874

Download Submit
C:\Users\Admin\AppData\Local\Temp\OiCmEUrdqMMK.bat

Filesize
199B

MD5
258ff03cd5de475865945ee351925507

SHA1
a5deab078401c7e84791769cf37615508fbb4641

SHA256
3cfaf67ffeb2a698b6f4c288c67b834a4d0e962e06f85cc83a301c159aa1959a

SHA512
1e8d832dd8766efbab85b86a8da06224d1210f26dbb41d9227dfc9080500221b2273c5827766e532ad9f66ce03b75124b6d1f99bd7ee34c8217c825926a06cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rf1UQnBjbn6z.bat

Filesize
199B

MD5
5c1461bb3c7d3eece44a9a90129085bf

SHA1
619d444980840aa8949a5b566308450bffff8366

SHA256
3b97ec0e6a7eca5f719c6d1832c1583e61ef021e9987965471e59c2ea9d0347b

SHA512
3fca0d746a3dd6da092c6eb85d2312993ce6f2c68cecf396ec7a929c190ff2593a87b3432cb18e203b3317093f1d3a38c621ed777f87da4c58cddc886380a7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\eJ5KfswpHWaJ.bat

Filesize
199B

MD5
4b97095fb0aca285958239443aa603d9

SHA1
aebb220c5615c67f5412078886cec28fe979b31b

SHA256
efeddabc5ac891b48754ca479a60fa24ff26e33de769114021fd509f7bce3a13

SHA512
12ce85e9c237fde830167023184fe5318c3913a848965ce689053c10562ff52698d43f4a930ed15ce7fdb0eca0c0c92ff782b120dc60ce10406e5d5a89575639

Download Submit
C:\Users\Admin\AppData\Local\Temp\hVE578NFXsEc.bat

Filesize
199B

MD5
d50255b01cc0da1eb0440f945c73318f

SHA1
72eb39f4d91ff417a2f42ce4387e6d4e542b54da

SHA256
743130a95f4505c1604aca1c6d96f908e8a2349a57dbdaa4bd8d2b2f6796d881

SHA512
9d5d6a958eb83b5e63712545e066170ed19b587d895da3b518bf47b079468949c1958ed290718fbe825973b9e1dd23687564d979eb9c24ac0f4436b585ff8387

Download Submit
C:\Users\Admin\AppData\Local\Temp\ixp7aDsdNilZ.bat

Filesize
199B

MD5
faac65926c0db325f7c3b6baee72973c

SHA1
23dd6f33a4540d29f7ab6b6698e33082b60a48e0

SHA256
831ea2ea632d838a63dc37944d368d3a3e08720772ab6bdbaa69572fdfaa2a1b

SHA512
b441c9c7820bd607d7f06dd5565a8deed19b76d1e8efd4a82fa1face43ff5a4141fff5a2446fefb9f8c9b6492f43c652f3f549d1d720fea07649d521ab080f50

Download Submit
C:\Users\Admin\AppData\Local\Temp\oXLlZ0ZvqGoW.bat

Filesize
199B

MD5
a9b5197fedd40d853d91bd22b787b0c7

SHA1
0303cb47ef4ce2c3904c5744be2009744fc9b49c

SHA256
4d791bf1e07ee8a5ae5a3f4804c57f22743946c2dc7ac7de11e3189a79c0806a

SHA512
2ee6b81e2e93ab13cbef56602463ea2acea6476dbf1acf1f961198c7eb316c8bdfebb12c8cff8d7499ff0a76ec633d8c56ee2025f874187b59cbbde6178cd7eb

Download Submit
C:\Windows\system32\a7\RuntimeBroker.exe

Filesize
3.1MB

MD5
82761cf21801c5a88775b5b82bce7dcd

SHA1
8e4bb300478b689915d241a18b8a9da5ba21b2b9

SHA256
e170577ede5b14116b8e2b3f4ccfa7865927aac68613cfd2676eef4f43819ddf

SHA512
2c45966635f2cc9bc53af8bb9070c4bd3f7d403f81fc40f58c0a0f2b04bfcd0a150092ae7a78971a9596ae0499cff98df0748eae8caacfabdfd522141b967425

Download Submit
memory/1156-108-0x00000000012E0000-0x0000000001604000-memory.dmp

Filesize
3.1MB

Download
memory/1684-2-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1684-1-0x0000000000070000-0x0000000000394000-memory.dmp

Filesize
3.1MB

Download
memory/1684-0-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/1684-10-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-20-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-8-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-11-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-9-0x0000000000160000-0x0000000000484000-memory.dmp

Filesize
3.1MB

Download
memory/2380-97-0x00000000001C0000-0x00000000004E4000-memory.dmp

Filesize
3.1MB

Download
memory/2652-129-0x00000000013D0000-0x00000000016F4000-memory.dmp

Filesize
3.1MB

Download
memory/2876-86-0x00000000012F0000-0x0000000001614000-memory.dmp

Filesize
3.1MB

Download
memory/2904-23-0x0000000001130000-0x0000000001454000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads