quasar | 4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd

Analysis

max time kernel
143s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RuntimeBroker.exe
Size

3.1MB
MD5

bdec971d6eb3ebfa2000191a40525746
SHA1

59f362a302cd3fba7c10c16ffac83eb2f099104f
SHA256

4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd
SHA512

c8a7e7bc180c6634732b3e4f42cc5029523882348d43272ac598f6640b9fb927b302ba2f35933e3c21efb77a1e902e66791a08a3fdc3b2677b15e306f4c664cd
SSDEEP

49152:Tv/lL26AaNeWgPhlmVqvMQ7XSKOJu6cBxXCoGdJTHHB72eh2NT:TvNL26AaNeWgPhlmVqkQ7XSKV6x

Score

10^/10

quasar runtimebroker discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

hahalol-49745.portmap.host:49745

Mutex

6ba66483-7407-4bb1-85ea-d79258d3bf46

Attributes

encryption_key
AAFD116557051025FAE9863551E989343167ADDF
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
a5

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 12 IoCs

resource	yara_rule
behavioral1/memory/2972-1-0x0000000000CD0000-0x0000000000FF4000-memory.dmp	family_quasar
behavioral1/files/0x0008000000016c7c-6.dat	family_quasar
behavioral1/memory/2104-9-0x00000000000D0000-0x00000000003F4000-memory.dmp	family_quasar
behavioral1/memory/2780-23-0x0000000000AF0000-0x0000000000E14000-memory.dmp	family_quasar
behavioral1/memory/1912-35-0x0000000000230000-0x0000000000554000-memory.dmp	family_quasar
behavioral1/memory/1752-46-0x00000000001D0000-0x00000000004F4000-memory.dmp	family_quasar
behavioral1/memory/836-57-0x0000000000180000-0x00000000004A4000-memory.dmp	family_quasar
behavioral1/memory/908-69-0x0000000000C80000-0x0000000000FA4000-memory.dmp	family_quasar
behavioral1/memory/896-80-0x0000000001110000-0x0000000001434000-memory.dmp	family_quasar
behavioral1/memory/2740-92-0x0000000001160000-0x0000000001484000-memory.dmp	family_quasar
behavioral1/memory/3052-103-0x0000000000050000-0x0000000000374000-memory.dmp	family_quasar
behavioral1/memory/2600-115-0x0000000001370000-0x0000000001694000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2104	RuntimeBroker.exe
2780	RuntimeBroker.exe
1912	RuntimeBroker.exe
1752	RuntimeBroker.exe
836	RuntimeBroker.exe
908	RuntimeBroker.exe
896	RuntimeBroker.exe
2740	RuntimeBroker.exe
3052	RuntimeBroker.exe
2600	RuntimeBroker.exe
568	RuntimeBroker.exe
1932	RuntimeBroker.exe
1640	RuntimeBroker.exe
1696	RuntimeBroker.exe
2068	RuntimeBroker.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File created	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2744	PING.EXE
2372	PING.EXE
2648	PING.EXE
316	PING.EXE
2404	PING.EXE
2860	PING.EXE
2000	PING.EXE
1520	PING.EXE
2264	PING.EXE
1320	PING.EXE
2288	PING.EXE
2148	PING.EXE
1292	PING.EXE
2144	PING.EXE
2844	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2744	PING.EXE
2144	PING.EXE
2648	PING.EXE
2404	PING.EXE
1320	PING.EXE
1292	PING.EXE
2372	PING.EXE
1520	PING.EXE
2860	PING.EXE
2844	PING.EXE
2148	PING.EXE
2000	PING.EXE
316	PING.EXE
2264	PING.EXE
2288	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2760	schtasks.exe
2340	schtasks.exe
1028	schtasks.exe
2624	schtasks.exe
2220	schtasks.exe
2328	schtasks.exe
3008	schtasks.exe
2412	schtasks.exe
1556	schtasks.exe
608	schtasks.exe
2972	schtasks.exe
800	schtasks.exe
1704	schtasks.exe
336	schtasks.exe
1684	schtasks.exe
1980	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	RuntimeBroker.exe
Token: SeDebugPrivilege	2104	RuntimeBroker.exe
Token: SeDebugPrivilege	2780	RuntimeBroker.exe
Token: SeDebugPrivilege	1912	RuntimeBroker.exe
Token: SeDebugPrivilege	1752	RuntimeBroker.exe
Token: SeDebugPrivilege	836	RuntimeBroker.exe
Token: SeDebugPrivilege	908	RuntimeBroker.exe
Token: SeDebugPrivilege	896	RuntimeBroker.exe
Token: SeDebugPrivilege	2740	RuntimeBroker.exe
Token: SeDebugPrivilege	3052	RuntimeBroker.exe
Token: SeDebugPrivilege	2600	RuntimeBroker.exe
Token: SeDebugPrivilege	568	RuntimeBroker.exe
Token: SeDebugPrivilege	1932	RuntimeBroker.exe
Token: SeDebugPrivilege	1640	RuntimeBroker.exe
Token: SeDebugPrivilege	1696	RuntimeBroker.exe
Token: SeDebugPrivilege	2068	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2412	2972	RuntimeBroker.exe	30
PID 2972 wrote to memory of 2412	2972	RuntimeBroker.exe	30
PID 2972 wrote to memory of 2412	2972	RuntimeBroker.exe	30
PID 2972 wrote to memory of 2104	2972	RuntimeBroker.exe	32
PID 2972 wrote to memory of 2104	2972	RuntimeBroker.exe	32
PID 2972 wrote to memory of 2104	2972	RuntimeBroker.exe	32
PID 2104 wrote to memory of 2760	2104	RuntimeBroker.exe	33
PID 2104 wrote to memory of 2760	2104	RuntimeBroker.exe	33
PID 2104 wrote to memory of 2760	2104	RuntimeBroker.exe	33
PID 2104 wrote to memory of 2820	2104	RuntimeBroker.exe	35
PID 2104 wrote to memory of 2820	2104	RuntimeBroker.exe	35
PID 2104 wrote to memory of 2820	2104	RuntimeBroker.exe	35
PID 2820 wrote to memory of 2772	2820	cmd.exe	37
PID 2820 wrote to memory of 2772	2820	cmd.exe	37
PID 2820 wrote to memory of 2772	2820	cmd.exe	37
PID 2820 wrote to memory of 2648	2820	cmd.exe	38
PID 2820 wrote to memory of 2648	2820	cmd.exe	38
PID 2820 wrote to memory of 2648	2820	cmd.exe	38
PID 2820 wrote to memory of 2780	2820	cmd.exe	39
PID 2820 wrote to memory of 2780	2820	cmd.exe	39
PID 2820 wrote to memory of 2780	2820	cmd.exe	39
PID 2780 wrote to memory of 2624	2780	RuntimeBroker.exe	40
PID 2780 wrote to memory of 2624	2780	RuntimeBroker.exe	40
PID 2780 wrote to memory of 2624	2780	RuntimeBroker.exe	40
PID 2780 wrote to memory of 1620	2780	RuntimeBroker.exe	42
PID 2780 wrote to memory of 1620	2780	RuntimeBroker.exe	42
PID 2780 wrote to memory of 1620	2780	RuntimeBroker.exe	42
PID 1620 wrote to memory of 1160	1620	cmd.exe	44
PID 1620 wrote to memory of 1160	1620	cmd.exe	44
PID 1620 wrote to memory of 1160	1620	cmd.exe	44
PID 1620 wrote to memory of 2148	1620	cmd.exe	45
PID 1620 wrote to memory of 2148	1620	cmd.exe	45
PID 1620 wrote to memory of 2148	1620	cmd.exe	45
PID 1620 wrote to memory of 1912	1620	cmd.exe	47
PID 1620 wrote to memory of 1912	1620	cmd.exe	47
PID 1620 wrote to memory of 1912	1620	cmd.exe	47
PID 1912 wrote to memory of 1704	1912	RuntimeBroker.exe	48
PID 1912 wrote to memory of 1704	1912	RuntimeBroker.exe	48
PID 1912 wrote to memory of 1704	1912	RuntimeBroker.exe	48
PID 1912 wrote to memory of 2868	1912	RuntimeBroker.exe	50
PID 1912 wrote to memory of 2868	1912	RuntimeBroker.exe	50
PID 1912 wrote to memory of 2868	1912	RuntimeBroker.exe	50
PID 2868 wrote to memory of 2420	2868	cmd.exe	52
PID 2868 wrote to memory of 2420	2868	cmd.exe	52
PID 2868 wrote to memory of 2420	2868	cmd.exe	52
PID 2868 wrote to memory of 2000	2868	cmd.exe	53
PID 2868 wrote to memory of 2000	2868	cmd.exe	53
PID 2868 wrote to memory of 2000	2868	cmd.exe	53
PID 2868 wrote to memory of 1752	2868	cmd.exe	54
PID 2868 wrote to memory of 1752	2868	cmd.exe	54
PID 2868 wrote to memory of 1752	2868	cmd.exe	54
PID 1752 wrote to memory of 2220	1752	RuntimeBroker.exe	55
PID 1752 wrote to memory of 2220	1752	RuntimeBroker.exe	55
PID 1752 wrote to memory of 2220	1752	RuntimeBroker.exe	55
PID 1752 wrote to memory of 1588	1752	RuntimeBroker.exe	57
PID 1752 wrote to memory of 1588	1752	RuntimeBroker.exe	57
PID 1752 wrote to memory of 1588	1752	RuntimeBroker.exe	57
PID 1588 wrote to memory of 1764	1588	cmd.exe	59
PID 1588 wrote to memory of 1764	1588	cmd.exe	59
PID 1588 wrote to memory of 1764	1588	cmd.exe	59
PID 1588 wrote to memory of 316	1588	cmd.exe	60
PID 1588 wrote to memory of 316	1588	cmd.exe	60
PID 1588 wrote to memory of 316	1588	cmd.exe	60
PID 1588 wrote to memory of 836	1588	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2412
- C:\Windows\system32\a5\RuntimeBroker.exe
  "C:\Windows\system32\a5\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2760
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\j5WxNNW32yoV.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2772
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2648
  - - C:\Windows\system32\a5\RuntimeBroker.exe
      "C:\Windows\system32\a5\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2624
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\cDS7VESuev8d.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1620
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1160
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2148
      - C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1704
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\uLjeTqNQLFdH.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2420
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2000
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2220
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\rItm05Hknzk8.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1764
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:316
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2340
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4QM9x6THd9hN.bat" "
        11⤵
        
        PID:1656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1356
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1520
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:336
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\16ZlRtnKB0K4.bat" "
        13⤵
        
        PID:2672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1728
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2264
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:896
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1556
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sF423jb9hv3c.bat" "
        15⤵
        
        PID:2940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2404
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2328
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\EnqdpftbEVc4.bat" "
        17⤵
        
        PID:2748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2112
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2744
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1684
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OYvOGAZpN2GE.bat" "
        19⤵
        
        PID:2364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1668
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2860
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\vnooXJzSpj8b.bat" "
        21⤵
        
        PID:1112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2212
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1320
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3008
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\HvWc8fp3Vf7x.bat" "
        23⤵
        
        PID:2232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2288
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:608
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\EATYww79WFV8.bat" "
        25⤵
        
        PID:2056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1292
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:800
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zIV3W4j4vvL6.bat" "
        27⤵
        
        PID:1628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2144
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1028
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DnVwKWW91ThT.bat" "
        29⤵
        
        PID:2540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2088
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2372
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\q2z8Jm9Q4h3q.bat" "
        31⤵
        
        PID:2804
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\16ZlRtnKB0K4.bat

Filesize
199B

MD5
0f6d06f4ad1c9f51f47b23714cd9e2b0

SHA1
970eb944b39385ec488f3877d175525b110d36b1

SHA256
b4c59ee3745e555405ba84aefa09c601f8b6a832ab0bdc33393c08bb2a82b859

SHA512
ec4d94e0981dc2b5e42c712f66a4db86c5cf897975eb6df128a6aa89fe76731050c2d1daae1120da4db2019636fcaf339e6551ca1d8f8e385937bec11b14dcfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\4QM9x6THd9hN.bat

Filesize
199B

MD5
33000d3eb138ccb5012ae96cafa0f78e

SHA1
613c6a2698fea27c2fadf1c1786734ce2f81e8bd

SHA256
83abd70460c7fb33d9b9d6d435be370e47100737135b95684fcef022caed7c6e

SHA512
83e0491e78f2bd07c1a8d3fc3f938f7fc592dd88acbb98cb0503eba383bfd2930106429aabe90a07d2715444033c342b863d9e659ae59299f4fa1b58ae1374c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\DnVwKWW91ThT.bat

Filesize
199B

MD5
d8b073ad787c10195408653de16a66f7

SHA1
a86d06394516bd3051cfbe473c5090a8a6477cc8

SHA256
45786be8818ede7a0a61b05f1ff95eeb937e89882f83ad1f53589d9d6de78ad1

SHA512
6393819babf252f8bb650617714d35253a923742a195e64ea365ee8348d31385f53b87dd026c84f0c15f5bb19b4c844c050eb0eff960a42d14afcfe8c4ccc345

Download Submit
C:\Users\Admin\AppData\Local\Temp\EATYww79WFV8.bat

Filesize
199B

MD5
0c7b86d5d8384090d38377f96d7ae47c

SHA1
a6701b432ec1459aa2192a46aafedcae9092e7e9

SHA256
32509baa590e63ff38b140756a8e742548f4b9ba3ce85b5fb02c800033f76c73

SHA512
d26f82d691c47d0de40365360194eb03bcf0c3446397b8cfee12c2350a1b68e872265597fbb1df3fe9763fd1e09bfcf5fa2e4d2a2e6f1684c2223204db496758

Download Submit
C:\Users\Admin\AppData\Local\Temp\EnqdpftbEVc4.bat

Filesize
199B

MD5
9084e842ca6212fbea8032e679a28417

SHA1
ee678cc33751f8012383bfbf33a7a859123ce6f8

SHA256
ef33ab55984277d2a9c36f24dd018d60e7d9118309495d4199a0439fd47eb745

SHA512
677585404e70715268a6ad5ce493fde52586c6cbee9be9d3e24c2711dd6478e66cda00ed1783451db7278d7b657fea6ec7064fd5c5e6f980854f28564a16775d

Download Submit
C:\Users\Admin\AppData\Local\Temp\HvWc8fp3Vf7x.bat

Filesize
199B

MD5
e0048d1f487d43e7aa61114e22bdb931

SHA1
1dd69dbed561578329d040e04644174eefb230c6

SHA256
7cc8e23a569ba161845f1105256e700f0161f93a5964431b21e961338ad84e21

SHA512
d481695349328ee360dbdfb25f4b5983569b19445062cc0e6d5371d75d8dc2aafec4a8aa13091240bd7ae060cc044ca80e48b599997a05e3387e8acb8806dc2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OYvOGAZpN2GE.bat

Filesize
199B

MD5
c0b47260c009204d0aa59badec0ab622

SHA1
6fbbb0ba91baa2543212edb9a9892f2b53864615

SHA256
c56292c5f5796e0dbd8b7e3d8f3ff477ff65e0e61658cb2e335b98b73e96426d

SHA512
717eff25c2eee2ae644934d90f38713fb959fce15708aeb4cdeb47684e48d734fdbcd5844081ccf823c11426c4df96d01fd57d232a1180a1c069bf0f7fcc7346

Download Submit
C:\Users\Admin\AppData\Local\Temp\cDS7VESuev8d.bat

Filesize
199B

MD5
ebd0f876f5046a6fa78baded680d7f60

SHA1
f2ce97e42b7a4b61f553484537d97fcadcfefd9e

SHA256
35d0e50a76b50e8a8655eb98935e5d48c5973b0c3d35392ae2864ea65af68028

SHA512
352cb6e9e33d60b626a6b2ffbc2d0dec1e9ebd6e21dcaf645755244fdc1a763cb7b716076f0bd4ffe4f44ea855bd776ca947f2c3d30801f7cdb19272f1e848e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\j5WxNNW32yoV.bat

Filesize
199B

MD5
94982eaf3a45e757e054f074a5bc8c40

SHA1
6ae9b010bbd5ab057dd3564b8c661ac853ff013e

SHA256
e7010cb60633222a5fa49d9980166fe21062adaeff97e3ccf7c765db7d6f7342

SHA512
aba25ef7a34458767fb4b986134426b4f7f7008601d7e4b469a54ad0b76638c59f13b781a95a6ee897946eff47b03250e88cbb04c196f6dca6f4d1c238b04566

Download Submit
C:\Users\Admin\AppData\Local\Temp\q2z8Jm9Q4h3q.bat

Filesize
199B

MD5
5f6532c0fd93cd1eb7851c1014178447

SHA1
fc0aa196b21dd2604c9d837b5922ae097d718f4d

SHA256
02edf30c460f9239a2ea158a3cb810e2503377bb8e5e3862ca947c0d81dfa981

SHA512
bbc44befff7e4022531ff24e5715e0626b64f46bdfc9f70b77e86276a86f025476c94588fe654cf334b74a1dcae3dc28f04d9bf8f480349f48308f1ba683cc45

Download Submit
C:\Users\Admin\AppData\Local\Temp\rItm05Hknzk8.bat

Filesize
199B

MD5
d0e310df32a62d228f5e260615ac6d86

SHA1
16d3dfffd0fa408c0633e29e7d3981e1b26b391c

SHA256
b54a7ee022e4c44f3960d680be18f7ebaadb0b76537d8de83b100a0cb61a9b3d

SHA512
6b0786bf42ed232d502acf7b3ef58421e9b568d68ee59168015c5f009905b3b4e7f0d85217fdadd54e8fce67bc373587a0fcf46930cddb7c230e253b3ea6058a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sF423jb9hv3c.bat

Filesize
199B

MD5
3f107d64b31b043ff6196ba99eb76d51

SHA1
56bfc76bf80f69c0d5df19c0139f90c8bceb406f

SHA256
650bc24237a6c3068946d2f18dbc8b758ef5c8acfe7fb762993fb18ed0a3bcaf

SHA512
99a5f82f13ac18d13f7631bd59b6beba3e57c015b4621e9344e93ee1af5bfe9a80229c7bd4bf688f67350a62db4314b84150aa975715fac263db7ef484e15362

Download Submit
C:\Users\Admin\AppData\Local\Temp\uLjeTqNQLFdH.bat

Filesize
199B

MD5
c0e76751e09818e643b146a989377538

SHA1
ef23f7713768de1ebf50ba6a0317bc74c99e88a4

SHA256
b2ac877f7458ba99bbb3fb0fb6f616c361884def039125d44c220aa0772a8e91

SHA512
af152ef809fc0fb6473cb098e4205fb9b8bb9a40a7f21e2ee221b9477d99f63b219dc37a63dc82cacb69e8194539516a33520d1a928767db5c465a2e8538637f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vnooXJzSpj8b.bat

Filesize
199B

MD5
ffc0d584211d87210a6c9ebb6d3f0283

SHA1
6fc330b79e46a8b5af6310ce867f98eb5799cb99

SHA256
aeaeda491e85c78b2454799abb3c69166247d7c58af70eaf046b37551afe8499

SHA512
d2d9e6d4f7f5a5e19543250225e1a88a4377b6323bf3a34eb484fe3fe39b69e7c04cc197368e2828c73afda73375884122f8d8dd10f5807aaab36dfe5c4d0b4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zIV3W4j4vvL6.bat

Filesize
199B

MD5
4937a83db70fb3e26495edec1671f90e

SHA1
4beac3aed1b988b3f489d7f8560284ff0050bb3b

SHA256
ed6076e1fd82872e3827e74c370730e81c537a9dbffed4e3cd4a78c27566648f

SHA512
1b36e99e5299f321bca0b4f5fb3151c40a4fd1b957dd78621f661ec7f158acb7c48a193899338fe1920a8d8be40ae325d7f9990fba8d68351de96fee8ccc1d75

Download Submit
C:\Windows\System32\a5\RuntimeBroker.exe

Filesize
3.1MB

MD5
bdec971d6eb3ebfa2000191a40525746

SHA1
59f362a302cd3fba7c10c16ffac83eb2f099104f

SHA256
4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd

SHA512
c8a7e7bc180c6634732b3e4f42cc5029523882348d43272ac598f6640b9fb927b302ba2f35933e3c21efb77a1e902e66791a08a3fdc3b2677b15e306f4c664cd

Download Submit
memory/836-57-0x0000000000180000-0x00000000004A4000-memory.dmp

Filesize
3.1MB

Download
memory/896-80-0x0000000001110000-0x0000000001434000-memory.dmp

Filesize
3.1MB

Download
memory/908-69-0x0000000000C80000-0x0000000000FA4000-memory.dmp

Filesize
3.1MB

Download
memory/1752-46-0x00000000001D0000-0x00000000004F4000-memory.dmp

Filesize
3.1MB

Download
memory/1912-35-0x0000000000230000-0x0000000000554000-memory.dmp

Filesize
3.1MB

Download
memory/2104-11-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2104-10-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2104-9-0x00000000000D0000-0x00000000003F4000-memory.dmp

Filesize
3.1MB

Download
memory/2104-20-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2600-115-0x0000000001370000-0x0000000001694000-memory.dmp

Filesize
3.1MB

Download
memory/2740-92-0x0000000001160000-0x0000000001484000-memory.dmp

Filesize
3.1MB

Download
memory/2780-23-0x0000000000AF0000-0x0000000000E14000-memory.dmp

Filesize
3.1MB

Download
memory/2972-8-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/2972-1-0x0000000000CD0000-0x0000000000FF4000-memory.dmp

Filesize
3.1MB

Download
memory/3052-103-0x0000000000050000-0x0000000000374000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads