quasar | 4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RuntimeBroker.exe
Size

3.1MB
MD5

bdec971d6eb3ebfa2000191a40525746
SHA1

59f362a302cd3fba7c10c16ffac83eb2f099104f
SHA256

4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd
SHA512

c8a7e7bc180c6634732b3e4f42cc5029523882348d43272ac598f6640b9fb927b302ba2f35933e3c21efb77a1e902e66791a08a3fdc3b2677b15e306f4c664cd
SSDEEP

49152:Tv/lL26AaNeWgPhlmVqvMQ7XSKOJu6cBxXCoGdJTHHB72eh2NT:TvNL26AaNeWgPhlmVqkQ7XSKV6x

Score

10^/10

quasar runtimebroker discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

hahalol-49745.portmap.host:49745

Mutex

6ba66483-7407-4bb1-85ea-d79258d3bf46

Attributes

encryption_key
AAFD116557051025FAE9863551E989343167ADDF
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
a5

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3392-1-0x0000000000A30000-0x0000000000D54000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023b78-5.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 15 IoCs

pid	Process
2296	RuntimeBroker.exe
2740	RuntimeBroker.exe
656	RuntimeBroker.exe
704	RuntimeBroker.exe
2704	RuntimeBroker.exe
3144	RuntimeBroker.exe
4448	RuntimeBroker.exe
2660	RuntimeBroker.exe
2140	RuntimeBroker.exe
2620	RuntimeBroker.exe
4056	RuntimeBroker.exe
4588	RuntimeBroker.exe
4104	RuntimeBroker.exe
4336	RuntimeBroker.exe
4172	RuntimeBroker.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File created	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3860	PING.EXE
1892	PING.EXE
3176	PING.EXE
2428	PING.EXE
1804	PING.EXE
760	PING.EXE
1600	PING.EXE
2320	PING.EXE
3392	PING.EXE
1648	PING.EXE
1944	PING.EXE
2520	PING.EXE
1972	PING.EXE
4804	PING.EXE
444	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2520	PING.EXE
3392	PING.EXE
1804	PING.EXE
1648	PING.EXE
4804	PING.EXE
1892	PING.EXE
1600	PING.EXE
3860	PING.EXE
1944	PING.EXE
444	PING.EXE
2428	PING.EXE
760	PING.EXE
1972	PING.EXE
3176	PING.EXE
2320	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5084	schtasks.exe
1304	schtasks.exe
4908	schtasks.exe
2664	schtasks.exe
2068	schtasks.exe
2000	schtasks.exe
4284	schtasks.exe
4900	schtasks.exe
2512	schtasks.exe
4968	schtasks.exe
1620	schtasks.exe
4960	schtasks.exe
1092	schtasks.exe
2316	schtasks.exe
2180	schtasks.exe
2660	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	RuntimeBroker.exe
Token: SeDebugPrivilege	2296	RuntimeBroker.exe
Token: SeDebugPrivilege	2740	RuntimeBroker.exe
Token: SeDebugPrivilege	656	RuntimeBroker.exe
Token: SeDebugPrivilege	704	RuntimeBroker.exe
Token: SeDebugPrivilege	2704	RuntimeBroker.exe
Token: SeDebugPrivilege	3144	RuntimeBroker.exe
Token: SeDebugPrivilege	4448	RuntimeBroker.exe
Token: SeDebugPrivilege	2660	RuntimeBroker.exe
Token: SeDebugPrivilege	2140	RuntimeBroker.exe
Token: SeDebugPrivilege	2620	RuntimeBroker.exe
Token: SeDebugPrivilege	4056	RuntimeBroker.exe
Token: SeDebugPrivilege	4588	RuntimeBroker.exe
Token: SeDebugPrivilege	4104	RuntimeBroker.exe
Token: SeDebugPrivilege	4336	RuntimeBroker.exe
Token: SeDebugPrivilege	4172	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 2660	3392	RuntimeBroker.exe	83
PID 3392 wrote to memory of 2660	3392	RuntimeBroker.exe	83
PID 3392 wrote to memory of 2296	3392	RuntimeBroker.exe	85
PID 3392 wrote to memory of 2296	3392	RuntimeBroker.exe	85
PID 2296 wrote to memory of 4284	2296	RuntimeBroker.exe	86
PID 2296 wrote to memory of 4284	2296	RuntimeBroker.exe	86
PID 2296 wrote to memory of 3004	2296	RuntimeBroker.exe	88
PID 2296 wrote to memory of 3004	2296	RuntimeBroker.exe	88
PID 3004 wrote to memory of 1232	3004	cmd.exe	90
PID 3004 wrote to memory of 1232	3004	cmd.exe	90
PID 3004 wrote to memory of 2520	3004	cmd.exe	91
PID 3004 wrote to memory of 2520	3004	cmd.exe	91
PID 3004 wrote to memory of 2740	3004	cmd.exe	99
PID 3004 wrote to memory of 2740	3004	cmd.exe	99
PID 2740 wrote to memory of 5084	2740	RuntimeBroker.exe	100
PID 2740 wrote to memory of 5084	2740	RuntimeBroker.exe	100
PID 2740 wrote to memory of 1620	2740	RuntimeBroker.exe	103
PID 2740 wrote to memory of 1620	2740	RuntimeBroker.exe	103
PID 1620 wrote to memory of 2840	1620	cmd.exe	105
PID 1620 wrote to memory of 2840	1620	cmd.exe	105
PID 1620 wrote to memory of 2428	1620	cmd.exe	106
PID 1620 wrote to memory of 2428	1620	cmd.exe	106
PID 1620 wrote to memory of 656	1620	cmd.exe	114
PID 1620 wrote to memory of 656	1620	cmd.exe	114
PID 656 wrote to memory of 1304	656	RuntimeBroker.exe	115
PID 656 wrote to memory of 1304	656	RuntimeBroker.exe	115
PID 656 wrote to memory of 3452	656	RuntimeBroker.exe	118
PID 656 wrote to memory of 3452	656	RuntimeBroker.exe	118
PID 3452 wrote to memory of 2328	3452	cmd.exe	120
PID 3452 wrote to memory of 2328	3452	cmd.exe	120
PID 3452 wrote to memory of 3392	3452	cmd.exe	121
PID 3452 wrote to memory of 3392	3452	cmd.exe	121
PID 3452 wrote to memory of 704	3452	cmd.exe	125
PID 3452 wrote to memory of 704	3452	cmd.exe	125
PID 704 wrote to memory of 4968	704	RuntimeBroker.exe	126
PID 704 wrote to memory of 4968	704	RuntimeBroker.exe	126
PID 704 wrote to memory of 5116	704	RuntimeBroker.exe	129
PID 704 wrote to memory of 5116	704	RuntimeBroker.exe	129
PID 5116 wrote to memory of 4632	5116	cmd.exe	131
PID 5116 wrote to memory of 4632	5116	cmd.exe	131
PID 5116 wrote to memory of 1804	5116	cmd.exe	132
PID 5116 wrote to memory of 1804	5116	cmd.exe	132
PID 5116 wrote to memory of 2704	5116	cmd.exe	135
PID 5116 wrote to memory of 2704	5116	cmd.exe	135
PID 2704 wrote to memory of 4900	2704	RuntimeBroker.exe	136
PID 2704 wrote to memory of 4900	2704	RuntimeBroker.exe	136
PID 2704 wrote to memory of 2980	2704	RuntimeBroker.exe	139
PID 2704 wrote to memory of 2980	2704	RuntimeBroker.exe	139
PID 2980 wrote to memory of 3208	2980	cmd.exe	141
PID 2980 wrote to memory of 3208	2980	cmd.exe	141
PID 2980 wrote to memory of 1648	2980	cmd.exe	142
PID 2980 wrote to memory of 1648	2980	cmd.exe	142
PID 2980 wrote to memory of 3144	2980	cmd.exe	144
PID 2980 wrote to memory of 3144	2980	cmd.exe	144
PID 3144 wrote to memory of 4908	3144	RuntimeBroker.exe	145
PID 3144 wrote to memory of 4908	3144	RuntimeBroker.exe	145
PID 3144 wrote to memory of 3524	3144	RuntimeBroker.exe	148
PID 3144 wrote to memory of 3524	3144	RuntimeBroker.exe	148
PID 3524 wrote to memory of 1492	3524	cmd.exe	150
PID 3524 wrote to memory of 1492	3524	cmd.exe	150
PID 3524 wrote to memory of 760	3524	cmd.exe	151
PID 3524 wrote to memory of 760	3524	cmd.exe	151
PID 3524 wrote to memory of 4448	3524	cmd.exe	154
PID 3524 wrote to memory of 4448	3524	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2660
- C:\Windows\system32\a5\RuntimeBroker.exe
  "C:\Windows\system32\a5\RuntimeBroker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nQCxIYbPKDym.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1232
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2520
  - - C:\Windows\system32\a5\RuntimeBroker.exe
      "C:\Windows\system32\a5\RuntimeBroker.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a07bs3uajRpV.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1620
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2840
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2428
      - C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OhI6s0MbBnqL.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3392
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yOJJ1OdzxoQ9.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4632
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1804
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1pkNxeq2eokn.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3208
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1648
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hm4HCyNMORMp.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1492
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:760
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4448
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WXqlxhcQWTnW.bat" "
        15⤵
        
        PID:3304
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3616
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3860
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SfB1zi1flmnm.bat" "
        17⤵
        
        PID:1504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1972
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4JKrhl5gpuAh.bat" "
        19⤵
        
        PID:3216
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3208
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4804
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qvZ3LkvYqOFd.bat" "
        21⤵
        
        PID:2628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1892
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4056
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QCgaLmlhqIH6.bat" "
        23⤵
        
        PID:4412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2316
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1600
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4588
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2CLkY2utNh19.bat" "
        25⤵
        
        PID:812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:5004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3176
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4104
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEoZ0oWWyVra.bat" "
        27⤵
        
        PID:60
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4112
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2320
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4336
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xZv3qmGhS77K.bat" "
        29⤵
        
        PID:372
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:5052
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1944
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NGU55cS0t0e3.bat" "
        31⤵
        
        PID:1472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:4932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\1pkNxeq2eokn.bat

Filesize
199B

MD5
ee96f78469c2133e41aa2d662f4f5bf5

SHA1
40bc6e73ea11f4b502e91bd7af81f9816a943682

SHA256
c03e3b7f65f6085679b5c46431d5a5d0986ea5db0662d009b6d75ec99211225b

SHA512
b0806bd1ca73972b528853aedb9fd265573827472cb7ecbef5dc8928e5a62b5a0f1cc7dfbddc6961741824c6285a7a2fa04029b11c4999840049e4aaa23018ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\2CLkY2utNh19.bat

Filesize
199B

MD5
514b32391890ff870643df7ccc23a25d

SHA1
7624cdc9caa1f578ffc875a98b353d2897884459

SHA256
e93cf20871f5f2ae580be40cdbc031d50e583c356230d2ab984ab88bad43bd99

SHA512
73f109ecd756a59ac17c9f8a040d1860844c1365d918788c8888d696a9dc349f9ed64cf250aa54277e0ef07e4065d770c772a9e74b7c297461a1a876535966ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\4JKrhl5gpuAh.bat

Filesize
199B

MD5
c514bcbd1e52d0341d0742d55bc98709

SHA1
9da21d0fe65018793942c80033baa5002918e728

SHA256
1051777413ada77c0fcda746535c6fbd110e19a9d551bff324e46ea5dfb49e6b

SHA512
5c9c3176ba2045d50adce6af9b3b764438174fdb4905bd462cf7e0e731c3a7f3b6c223744cd3f2685edc7f69dbfb041967fe71104c6d33b2e721b6eaab09df26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hm4HCyNMORMp.bat

Filesize
199B

MD5
2c616e73fe2d2484b648d587f642bbb1

SHA1
5dd196ba9cdc5f79b00884d22e1d2727da2a1438

SHA256
9a035eda58dc7227a16168bc64a419eceff00b72785c7ee256a4aa490b8d37a3

SHA512
0503642a0d3e09bd76dc18d516e1d9c476024e04d398d2f56d54bd4fc0de81ac507a7b004dcc5949a127ea0d5c547b5d0cee406927a85a6089e0cdded6e582fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\NGU55cS0t0e3.bat

Filesize
199B

MD5
a8eab797565f2acdf45468a4de60ea83

SHA1
9bc446b805332245bfcd2c3598d9eca2ae119244

SHA256
8c6c7ce006d3d145ff42c0499e46194d74889fa51d50120cbcbbdc97a03530ec

SHA512
6c31cd7904c104bf620f28aba2c29316b72dd9187c1e9e979fb7c3f0e99d7cf714aef9d47008fb1c1ce0246b1e5393985367d857e92ce68cce278e413d81f1f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OhI6s0MbBnqL.bat

Filesize
199B

MD5
461df1bb17a56c699417e9f4134e36e6

SHA1
884456993c26da201a40c178955fd3f7da41341f

SHA256
8d88f5c063053184c54851ff34ce9e8d11d3cf99a5078f678ef73eb9b3beef6e

SHA512
cf095cc8bfe1cf7b9b97fd721f9d60927a7139bd1f11206ce6cb517c8208ea3b8f406968eb2262adee0ccfc1cdb3c70a29f8a74e448702f67c7146a1fcc005a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\QCgaLmlhqIH6.bat

Filesize
199B

MD5
592ec87fcf6df4efe70d54798da97238

SHA1
8679c142733182cd48bd5916b935bb69fa851f1c

SHA256
0133af93b51bb7dff7835251fd21cf1fa71a589241aa6741ffd95622c1edbea6

SHA512
60f374ddb25e2955a2b3b16bb8cade412225308d32f3e573832f129eb74d673fcd4bfd70c649265d3ca6f3639398437daac19583336a46245881df97908f6ee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SfB1zi1flmnm.bat

Filesize
199B

MD5
67fb5311a23663281fefa7336bbe4b50

SHA1
6a36add7903a4b9fdc0ff202d32c8372526b86f1

SHA256
ac77952596a2ad4a6e6a95ef30e4c4552df7fa3c6a8cc827664678d6ee385cf6

SHA512
e6975121813624fd102c409007261cbea762ada66275ccc6b4400250808a16684fa9bacc7324e2710735f3b6ea2510bf5fffd1757dddb0f5562e1cd7bf01bec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WXqlxhcQWTnW.bat

Filesize
199B

MD5
d1fd168e74f92e59d94f1f0a1ed4ce72

SHA1
627c1e6c4648b3659078b3996cad297e247c305e

SHA256
c9472007bb8666d074b2ae0e0fd28c62328a307b14f8574e8a0127574c278f44

SHA512
b96133baea4571e92909d4ffb983870aa2335e7b9444e6b0b81e120918d3c294d384c830cdc2bab04a8f5b28acb2a6d8faacf2ee06314b9166fa91f6ef615e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a07bs3uajRpV.bat

Filesize
199B

MD5
88f86c985df91238f9d5502d0d8ab1d9

SHA1
e3210ad12ddb2aac91009efff924d8aa1a46a1f9

SHA256
637a310cb55dd94140d5a454e1cc0072e192f11454f12c911a889ab18e63b836

SHA512
2234eaa1983a409960cb85328e48ed22ec36a2ead93ff1072d79c3dd13b48155563147220c119380b5a52f964ab691c96e76480b5a4073f3c97f8ea3ef8c5b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nQCxIYbPKDym.bat

Filesize
199B

MD5
2233680c908d1dad2f5c0f95dc8aec61

SHA1
758d9888a8bf89ca0e6c0e46f8e127d73d9ae125

SHA256
f88b20d36542f195a9874db053dedf78b86afd5ea038db10213d7cd523e87b27

SHA512
8f957511a78c3ba818f386aa337b257f5cf2933b305476695bd34717131dd6998243a6fc4259ee8feeac84e509e190380999731c706023b1f4e6ac307540c5ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\qvZ3LkvYqOFd.bat

Filesize
199B

MD5
e7b1a3268371769fa634d5b24bf0ffdd

SHA1
64017c228ce566418ee86800656532114ea8f445

SHA256
c0e3b46ca4bfaa5dd1e3d9461daf2d200fc7036649eb0e9a247680ce63fe5a16

SHA512
5dcea10bc6c7d4d9e96f238b73d5ecdbab62103c23710186a889231c03c71a49fb7ce5a25149656a67fb838b02c1b0f605cc645a6327e9c53e4ca671c002a5cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\xZv3qmGhS77K.bat

Filesize
199B

MD5
c7eed8cdbb7e2d032a26e84d9428b49e

SHA1
9308a49e83c2bcedce3673d75e353d93b54d7444

SHA256
eb2499833f8b8d2c1df854887a60893f63d7dfa9c9c766f130bd8bee8b990d5a

SHA512
75ba65872abab72f2dddd228675b6a3891d891e6c998d3fd896a529d4db20c33c992773336bc74fb5282ef54cba2a9787f0a56fad882d9a3e2e3e38c81f4b75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\yEoZ0oWWyVra.bat

Filesize
199B

MD5
1f9af773fccd4f09ef0eb9b279988d55

SHA1
bde59a664911c93b55aa302d0dadbe9ec3e3ee7a

SHA256
d7d3b6f8c78b6282820efb8abcd792c1ddf3f8d994776420b0ee44351855682b

SHA512
e701e588d96570ba9677cc73fa5c31c3333d718b16ab5e6371b044b0b1dbf5883e8a1fd6bce462a7c8d875f2c2f5c8a50ec2942f222e252cf76b24b8ebbda78d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yOJJ1OdzxoQ9.bat

Filesize
199B

MD5
5351a8bb691e59f84c2bfb137e6e9a3b

SHA1
f6ea7446c206467ae47ec0e386e1ae04b441470c

SHA256
f119a801458b8cad95b5417d8dddd6bf43def02c51ae35e72f182205b877b7f4

SHA512
f0ba7e5369c56c5f071dc74d7c8054549c213966fc4961333ec26103f2426af90db0291af26c073b8dd7b272504f6e227e0beeebc0183f00d9db5dc7054c16d0

Download Submit
C:\Windows\System32\a5\RuntimeBroker.exe

Filesize
3.1MB

MD5
bdec971d6eb3ebfa2000191a40525746

SHA1
59f362a302cd3fba7c10c16ffac83eb2f099104f

SHA256
4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd

SHA512
c8a7e7bc180c6634732b3e4f42cc5029523882348d43272ac598f6640b9fb927b302ba2f35933e3c21efb77a1e902e66791a08a3fdc3b2677b15e306f4c664cd

Download Submit
memory/2296-9-0x00007FFED1090000-0x00007FFED1B51000-memory.dmp

Filesize
10.8MB

Download
memory/2296-10-0x000000001BFB0000-0x000000001C000000-memory.dmp

Filesize
320KB

Download
memory/2296-11-0x000000001D6C0000-0x000000001D772000-memory.dmp

Filesize
712KB

Download
memory/2296-15-0x00007FFED1090000-0x00007FFED1B51000-memory.dmp

Filesize
10.8MB

Download
memory/3392-0-0x00007FFED1093000-0x00007FFED1095000-memory.dmp

Filesize
8KB

Download
memory/3392-1-0x0000000000A30000-0x0000000000D54000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads