quasar | 4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd

Analysis

max time kernel
143s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RuntimeBroker.exe
Size

3.1MB
MD5

bdec971d6eb3ebfa2000191a40525746
SHA1

59f362a302cd3fba7c10c16ffac83eb2f099104f
SHA256

4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd
SHA512

c8a7e7bc180c6634732b3e4f42cc5029523882348d43272ac598f6640b9fb927b302ba2f35933e3c21efb77a1e902e66791a08a3fdc3b2677b15e306f4c664cd
SSDEEP

49152:Tv/lL26AaNeWgPhlmVqvMQ7XSKOJu6cBxXCoGdJTHHB72eh2NT:TvNL26AaNeWgPhlmVqkQ7XSKV6x

Score

10^/10

quasar runtimebroker discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

hahalol-49745.portmap.host:49745

Mutex

6ba66483-7407-4bb1-85ea-d79258d3bf46

Attributes

encryption_key
AAFD116557051025FAE9863551E989343167ADDF
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
a5

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 11 IoCs

resource	yara_rule
behavioral1/memory/1372-1-0x0000000000E00000-0x0000000001124000-memory.dmp	family_quasar
behavioral1/files/0x000700000001945b-6.dat	family_quasar
behavioral1/memory/2344-9-0x0000000000BF0000-0x0000000000F14000-memory.dmp	family_quasar
behavioral1/memory/2584-23-0x0000000000020000-0x0000000000344000-memory.dmp	family_quasar
behavioral1/memory/1080-34-0x0000000001170000-0x0000000001494000-memory.dmp	family_quasar
behavioral1/memory/2760-108-0x0000000001190000-0x00000000014B4000-memory.dmp	family_quasar
behavioral1/memory/2240-119-0x0000000000370000-0x0000000000694000-memory.dmp	family_quasar
behavioral1/memory/1696-130-0x0000000000090000-0x00000000003B4000-memory.dmp	family_quasar
behavioral1/memory/3068-141-0x0000000000EE0000-0x0000000001204000-memory.dmp	family_quasar
behavioral1/memory/1936-153-0x00000000001F0000-0x0000000000514000-memory.dmp	family_quasar
behavioral1/memory/2664-164-0x0000000001320000-0x0000000001644000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2344	RuntimeBroker.exe
2584	RuntimeBroker.exe
1080	RuntimeBroker.exe
2948	RuntimeBroker.exe
1132	RuntimeBroker.exe
596	RuntimeBroker.exe
1564	RuntimeBroker.exe
628	RuntimeBroker.exe
1512	RuntimeBroker.exe
2760	RuntimeBroker.exe
2240	RuntimeBroker.exe
1696	RuntimeBroker.exe
3068	RuntimeBroker.exe
1936	RuntimeBroker.exe
2664	RuntimeBroker.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File created	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
348	PING.EXE
1488	PING.EXE
1140	PING.EXE
1740	PING.EXE
2372	PING.EXE
2716	PING.EXE
1036	PING.EXE
2896	PING.EXE
1064	PING.EXE
980	PING.EXE
3060	PING.EXE
2504	PING.EXE
2036	PING.EXE
2832	PING.EXE
1152	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1036	PING.EXE
1152	PING.EXE
1488	PING.EXE
980	PING.EXE
1740	PING.EXE
2716	PING.EXE
348	PING.EXE
1064	PING.EXE
2372	PING.EXE
2896	PING.EXE
2504	PING.EXE
1140	PING.EXE
2832	PING.EXE
2036	PING.EXE
3060	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2020	schtasks.exe
1784	schtasks.exe
2444	schtasks.exe
2472	schtasks.exe
2844	schtasks.exe
1800	schtasks.exe
2192	schtasks.exe
2776	schtasks.exe
2284	schtasks.exe
2120	schtasks.exe
2648	schtasks.exe
2204	schtasks.exe
952	schtasks.exe
1052	schtasks.exe
2680	schtasks.exe
1184	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	RuntimeBroker.exe
Token: SeDebugPrivilege	2344	RuntimeBroker.exe
Token: SeDebugPrivilege	2584	RuntimeBroker.exe
Token: SeDebugPrivilege	1080	RuntimeBroker.exe
Token: SeDebugPrivilege	2948	RuntimeBroker.exe
Token: SeDebugPrivilege	1132	RuntimeBroker.exe
Token: SeDebugPrivilege	596	RuntimeBroker.exe
Token: SeDebugPrivilege	1564	RuntimeBroker.exe
Token: SeDebugPrivilege	628	RuntimeBroker.exe
Token: SeDebugPrivilege	1512	RuntimeBroker.exe
Token: SeDebugPrivilege	2760	RuntimeBroker.exe
Token: SeDebugPrivilege	2240	RuntimeBroker.exe
Token: SeDebugPrivilege	1696	RuntimeBroker.exe
Token: SeDebugPrivilege	3068	RuntimeBroker.exe
Token: SeDebugPrivilege	1936	RuntimeBroker.exe
Token: SeDebugPrivilege	2664	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1800	1372	RuntimeBroker.exe	30
PID 1372 wrote to memory of 1800	1372	RuntimeBroker.exe	30
PID 1372 wrote to memory of 1800	1372	RuntimeBroker.exe	30
PID 1372 wrote to memory of 2344	1372	RuntimeBroker.exe	32
PID 1372 wrote to memory of 2344	1372	RuntimeBroker.exe	32
PID 1372 wrote to memory of 2344	1372	RuntimeBroker.exe	32
PID 2344 wrote to memory of 2192	2344	RuntimeBroker.exe	33
PID 2344 wrote to memory of 2192	2344	RuntimeBroker.exe	33
PID 2344 wrote to memory of 2192	2344	RuntimeBroker.exe	33
PID 2344 wrote to memory of 3064	2344	RuntimeBroker.exe	35
PID 2344 wrote to memory of 3064	2344	RuntimeBroker.exe	35
PID 2344 wrote to memory of 3064	2344	RuntimeBroker.exe	35
PID 3064 wrote to memory of 2932	3064	cmd.exe	37
PID 3064 wrote to memory of 2932	3064	cmd.exe	37
PID 3064 wrote to memory of 2932	3064	cmd.exe	37
PID 3064 wrote to memory of 2716	3064	cmd.exe	38
PID 3064 wrote to memory of 2716	3064	cmd.exe	38
PID 3064 wrote to memory of 2716	3064	cmd.exe	38
PID 3064 wrote to memory of 2584	3064	cmd.exe	40
PID 3064 wrote to memory of 2584	3064	cmd.exe	40
PID 3064 wrote to memory of 2584	3064	cmd.exe	40
PID 2584 wrote to memory of 2648	2584	RuntimeBroker.exe	41
PID 2584 wrote to memory of 2648	2584	RuntimeBroker.exe	41
PID 2584 wrote to memory of 2648	2584	RuntimeBroker.exe	41
PID 2584 wrote to memory of 616	2584	RuntimeBroker.exe	43
PID 2584 wrote to memory of 616	2584	RuntimeBroker.exe	43
PID 2584 wrote to memory of 616	2584	RuntimeBroker.exe	43
PID 616 wrote to memory of 1708	616	cmd.exe	45
PID 616 wrote to memory of 1708	616	cmd.exe	45
PID 616 wrote to memory of 1708	616	cmd.exe	45
PID 616 wrote to memory of 2896	616	cmd.exe	46
PID 616 wrote to memory of 2896	616	cmd.exe	46
PID 616 wrote to memory of 2896	616	cmd.exe	46
PID 616 wrote to memory of 1080	616	cmd.exe	47
PID 616 wrote to memory of 1080	616	cmd.exe	47
PID 616 wrote to memory of 1080	616	cmd.exe	47
PID 1080 wrote to memory of 2776	1080	RuntimeBroker.exe	48
PID 1080 wrote to memory of 2776	1080	RuntimeBroker.exe	48
PID 1080 wrote to memory of 2776	1080	RuntimeBroker.exe	48
PID 1080 wrote to memory of 1384	1080	RuntimeBroker.exe	50
PID 1080 wrote to memory of 1384	1080	RuntimeBroker.exe	50
PID 1080 wrote to memory of 1384	1080	RuntimeBroker.exe	50
PID 1384 wrote to memory of 544	1384	cmd.exe	52
PID 1384 wrote to memory of 544	1384	cmd.exe	52
PID 1384 wrote to memory of 544	1384	cmd.exe	52
PID 1384 wrote to memory of 1152	1384	cmd.exe	53
PID 1384 wrote to memory of 1152	1384	cmd.exe	53
PID 1384 wrote to memory of 1152	1384	cmd.exe	53
PID 1384 wrote to memory of 2948	1384	cmd.exe	54
PID 1384 wrote to memory of 2948	1384	cmd.exe	54
PID 1384 wrote to memory of 2948	1384	cmd.exe	54
PID 2948 wrote to memory of 2204	2948	RuntimeBroker.exe	55
PID 2948 wrote to memory of 2204	2948	RuntimeBroker.exe	55
PID 2948 wrote to memory of 2204	2948	RuntimeBroker.exe	55
PID 2948 wrote to memory of 1792	2948	RuntimeBroker.exe	57
PID 2948 wrote to memory of 1792	2948	RuntimeBroker.exe	57
PID 2948 wrote to memory of 1792	2948	RuntimeBroker.exe	57
PID 1792 wrote to memory of 2056	1792	cmd.exe	59
PID 1792 wrote to memory of 2056	1792	cmd.exe	59
PID 1792 wrote to memory of 2056	1792	cmd.exe	59
PID 1792 wrote to memory of 348	1792	cmd.exe	60
PID 1792 wrote to memory of 348	1792	cmd.exe	60
PID 1792 wrote to memory of 348	1792	cmd.exe	60
PID 1792 wrote to memory of 1132	1792	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1800
- C:\Windows\system32\a5\RuntimeBroker.exe
  "C:\Windows\system32\a5\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2192
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\W1N5kKASuKZV.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2932
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2716
  - - C:\Windows\system32\a5\RuntimeBroker.exe
      "C:\Windows\system32\a5\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2648
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6QTRpPBibNJb.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:616
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1708
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2896
      - C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2776
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RAK5TUn8KPeV.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1152
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2204
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\vHKf7nrble9N.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2056
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:348
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1132
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:952
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\wWCeaQyg2cn6.bat" "
        11⤵
        
        PID:2028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2504
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:596
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2284
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\9adds1xEbpBi.bat" "
        13⤵
        
        PID:1740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1488
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2020
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\kaFdChNtULxp.bat" "
        15⤵
        
        PID:2148
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2924
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2036
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1784
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\3hyUVotn6ZaP.bat" "
        17⤵
        
        PID:2696
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2716
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3060
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1052
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\iVv6KbGaDUwE.bat" "
        19⤵
        
        PID:2612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1568
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1064
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2120
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\IAH3HRl94rNj.bat" "
        21⤵
        
        PID:1080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2940
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:980
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2680
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DLGFKI1fcF6I.bat" "
        23⤵
        
        PID:2384
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1036
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1184
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6bGmhOMYiba7.bat" "
        25⤵
        
        PID:1552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2504
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1140
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2444
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Fs3bjzE8YER9.bat" "
        27⤵
        
        PID:1504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2196
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1740
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2472
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\oHysY0Iffxar.bat" "
        29⤵
        
        PID:552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2372
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2844
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tpqU63wKyucq.bat" "
        31⤵
        
        PID:2864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3hyUVotn6ZaP.bat

Filesize
199B

MD5
683f07fd0aacbfaf79f7e850adfe4386

SHA1
82d17eafbf3d2e6dd6185ab382a599e0f6fd7be6

SHA256
eed0b60a23ce6e3a2c1f3e77107764bd4643c045eec500f61ca65a08f5dcc0b1

SHA512
cd47711919dcce9fdc04300e9ff159ec402173ae9407b8606cd311c9a2d73793ba4d04168e74e4ceae7a60a23e4a4f76271acd6db469eb27079ef22797e8b04f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6QTRpPBibNJb.bat

Filesize
199B

MD5
8a48273861c7a807da3990499775415d

SHA1
99c72c6ceacd2ac88db8540561a7e786b676bd85

SHA256
7b7a2b984db32c0ed446ff20f471b53ccdedc955bb0c7bb67d4efa1e606ce698

SHA512
149e7ce267ba384f9efca57789b0b08e3999aca08fdc6e6a00ff4a071287274d1d43374b1cc5cdb52cd122aa4b759c8290aa9a464adbf80a74ff935d8afef36c

Download Submit
C:\Users\Admin\AppData\Local\Temp\6bGmhOMYiba7.bat

Filesize
199B

MD5
3b0a4604395c7d017f0681bb35b07ee7

SHA1
95a61e95c317f3d6cdcc21f1ee07b62acf363983

SHA256
bf20537a3d4b0731537aea2dd1351b1b85c537d87a9b7009faf9b8e8af293629

SHA512
d9ae67fc83c5910f2a17e100265a51fa075a460af0ae6aab03e95c57a97e4c5532b47d1f3d14f9bd3f91c96eebe18110a0479c51ec8f5f756ae69eba82d6611d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9adds1xEbpBi.bat

Filesize
199B

MD5
a6e2d95750526d9656c699233bbb3878

SHA1
f4e943a1f931d73e90552d50cd9103db23c95f14

SHA256
edbd5d6e0abb1cc6ce422002f1f31e3e010a90c212976021d36e28412a69e1a5

SHA512
b9f4aef19836b9074f11c70b0403325a3af54ed4caa15de01cf76d47f333e34da85e03fa94a8dad315e2bb871e0512eef79a356a5bc3b01b8aad7ce3092f8de9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DLGFKI1fcF6I.bat

Filesize
199B

MD5
6e7eecf708b75fcd9d6e95dc5f7b61a5

SHA1
ec639d06e61fd76ade0e772b192d580951f887c2

SHA256
cd6021d8cac0c7ad313158664a166cdf697769bd7dca30d7939a12c504c27189

SHA512
bf206ce6ba211ac322f1b637b6e3c7919a9c29f639a16e6d803c26de729cd49476d0f1f2cb4205e652e908dd0bb055e49cd443149886f6b03fc1bf102b838000

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fs3bjzE8YER9.bat

Filesize
199B

MD5
1a1b81486ccd5c527c128f6140100cb7

SHA1
277238d10e1b4faa91b6e25b3c6e1465fea790b3

SHA256
684702562b377aadcad0260735b3247712dc1f9a271b86be745e999c8e8ffdde

SHA512
0ccbe79e5ab9cf2ba2fa2b79e3fa2c09e8ef7ddc6106f9e8879db01399fd03303f38d587f345ce926265cf21780e2c710dd8195e155a7afc926c9eca16ef7349

Download Submit
C:\Users\Admin\AppData\Local\Temp\IAH3HRl94rNj.bat

Filesize
199B

MD5
244ba3f0bc9c6a9d71c9fe93ff6f5b5b

SHA1
55336b6c92763fa9b4752c796ecfe83585fb729f

SHA256
e10e4e54229e0d811cd7ddc6f9b7640dd9d9c457587f848e12db8e0d838e2700

SHA512
c5831935f0fcf9babe790d82a0828ea9721ea1521dc93e3c8220715d835a26aeb8d5431f69e53dc3b93ece049e3f7de4329651ed42f36b5f60211dbfa96ce242

Download Submit
C:\Users\Admin\AppData\Local\Temp\RAK5TUn8KPeV.bat

Filesize
199B

MD5
e53e587cb5090b641a913cc33428ecba

SHA1
3638214044fa7cf0374e6f14013706a3379a3212

SHA256
1b177c6be9c49105710379974bba30e69435fb37ebc32db33517ef921b7f5746

SHA512
7051ef66829a1b5d59e5e33415443d5951b03e6d1da39f21a2f16d71e280f894fc87bac413784d5aed6e8ee6a493be0ecbd02a763b34faf05e2b25d2ec9cdabc

Download Submit
C:\Users\Admin\AppData\Local\Temp\W1N5kKASuKZV.bat

Filesize
199B

MD5
5dd119f1c2212856dff8069230ef0e15

SHA1
19907b1d9b051810781de971e710e154831ed644

SHA256
7daf1dcc7114ef95a8d7cb71181a6fffec77afde95941356c5c7c63ce506579c

SHA512
b62575100d10e15dec92468691c57e9c719f12321edcaf4240d34bb33881f84ee3ca6f2374ae93838f90dd32e418809fa3d19d340a292595362fb877cfe035a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\iVv6KbGaDUwE.bat

Filesize
199B

MD5
ac4e0a61975e14ffcd2c338953a46dda

SHA1
daf86118f33442e4580b918bebff23caf8f26258

SHA256
8a2a4673c2c4968c7117df8d3c895a0ab9ca6663a558127f708f308bce02ea63

SHA512
c695f9229709b0d1302503d932d6381815c426a7d53dc3372733ca7227cf4c46791b7d8f5fa452e6f689abd154bddd89fa2f0e29126406adfbfe9bdc4403d629

Download Submit
C:\Users\Admin\AppData\Local\Temp\kaFdChNtULxp.bat

Filesize
199B

MD5
06435e65503a5047879499719678f1c2

SHA1
5b5da5b0c2ae09a946e8357f1ae5e8fa1ed0b823

SHA256
407be33f1db4f28181005d54bb90921b8778839caf0a369b50e171e65f05afe1

SHA512
b4c79fc83231b0b99e1a148cbd2d7ec4154e629af4d38bb6636510b11243027dc38777142a6088edb2c4629ee9d1d59978af612547adf8a45da902f9f974cf23

Download Submit
C:\Users\Admin\AppData\Local\Temp\oHysY0Iffxar.bat

Filesize
199B

MD5
aacd21d9f200775d9fd2072b725a8b42

SHA1
bd3d9cb6081a19c2a5ac9e81907064d7d81818b9

SHA256
f91f5cbe440b3dd96251ecc65350fef30d2dc4bbe70d65030230608d9618d18c

SHA512
8839f31f9c20a0f637d9e0fab2971b766dfe515d20dd216548bb5936c39d2a223e46bce9cbf9af29b0302196f0a9977ff27bf2e44c3f069ccb2e349e96ac2ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tpqU63wKyucq.bat

Filesize
199B

MD5
863c0503f4c20b67ad70d6f1c6931d1f

SHA1
7062fcb8995d393008adbab8c1cba90fe5f5626a

SHA256
0670c7ef47bf72c0107499502eb3c71639465a231582a0331c12e34a0ec8c6dd

SHA512
17d62b15ba43a64bd0d2a46a179317e240605081df2614a878208fc8e0787718a0acd076cc8c857fbfdc5edcb16931f805f7e50bc53e6b3fd8551a0cb4d9f668

Download Submit
C:\Users\Admin\AppData\Local\Temp\vHKf7nrble9N.bat

Filesize
199B

MD5
397d58209a4b0b6943b8d7abe1b6bfc1

SHA1
ef9d2c03dc6747fd020681b35ebce28571ac4e83

SHA256
db9ce46a0690fee7360ef734d448b5cc56b5af92a3339619334be069fcdc028d

SHA512
e02291f62a79ab31a19a5f37877b00095549c4079d9ab147c31bd16b2df9b352087e651cfd7b356b421cef664ae23d40dc6f613a78f60f56355f33513de22bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\wWCeaQyg2cn6.bat

Filesize
199B

MD5
8a1aed736ce9aadf4122b85ecae7cde1

SHA1
3e33f12adfe36f81f4a0b0214a23da06d7ee4425

SHA256
65645af2babff43f03242ec9f9e7f52e12367d8c1aa46cec457b7a141d2ef092

SHA512
875dee658b54d06d87dac22ba4051c658261ad6396829773a04b90b61967981c7bb436b8e1b011916999e06c45ed12ddf1f47b61167a4901d8287820bbc0a903

Download Submit
C:\Windows\System32\a5\RuntimeBroker.exe

Filesize
3.1MB

MD5
bdec971d6eb3ebfa2000191a40525746

SHA1
59f362a302cd3fba7c10c16ffac83eb2f099104f

SHA256
4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd

SHA512
c8a7e7bc180c6634732b3e4f42cc5029523882348d43272ac598f6640b9fb927b302ba2f35933e3c21efb77a1e902e66791a08a3fdc3b2677b15e306f4c664cd

Download Submit
memory/1080-34-0x0000000001170000-0x0000000001494000-memory.dmp

Filesize
3.1MB

Download
memory/1372-2-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download
memory/1372-8-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download
memory/1372-0-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

Filesize
4KB

Download
memory/1372-1-0x0000000000E00000-0x0000000001124000-memory.dmp

Filesize
3.1MB

Download
memory/1696-130-0x0000000000090000-0x00000000003B4000-memory.dmp

Filesize
3.1MB

Download
memory/1936-153-0x00000000001F0000-0x0000000000514000-memory.dmp

Filesize
3.1MB

Download
memory/2240-119-0x0000000000370000-0x0000000000694000-memory.dmp

Filesize
3.1MB

Download
memory/2344-9-0x0000000000BF0000-0x0000000000F14000-memory.dmp

Filesize
3.1MB

Download
memory/2344-20-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download
memory/2344-11-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download
memory/2344-10-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download
memory/2584-23-0x0000000000020000-0x0000000000344000-memory.dmp

Filesize
3.1MB

Download
memory/2664-164-0x0000000001320000-0x0000000001644000-memory.dmp

Filesize
3.1MB

Download
memory/2760-108-0x0000000001190000-0x00000000014B4000-memory.dmp

Filesize
3.1MB

Download
memory/3068-141-0x0000000000EE0000-0x0000000001204000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads