quasar | 4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe
Size

3.1MB
MD5

bdec971d6eb3ebfa2000191a40525746
SHA1

59f362a302cd3fba7c10c16ffac83eb2f099104f
SHA256

4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd
SHA512

c8a7e7bc180c6634732b3e4f42cc5029523882348d43272ac598f6640b9fb927b302ba2f35933e3c21efb77a1e902e66791a08a3fdc3b2677b15e306f4c664cd
SSDEEP

49152:Tv/lL26AaNeWgPhlmVqvMQ7XSKOJu6cBxXCoGdJTHHB72eh2NT:TvNL26AaNeWgPhlmVqkQ7XSKV6x

Score

10^/10

quasar runtimebroker discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

hahalol-49745.portmap.host:49745

Mutex

6ba66483-7407-4bb1-85ea-d79258d3bf46

Attributes

encryption_key
AAFD116557051025FAE9863551E989343167ADDF
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
a5

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 9 IoCs

resource	yara_rule
behavioral1/memory/1152-1-0x00000000009D0000-0x0000000000CF4000-memory.dmp	family_quasar
behavioral1/files/0x0008000000015fc4-6.dat	family_quasar
behavioral1/memory/2368-9-0x0000000000150000-0x0000000000474000-memory.dmp	family_quasar
behavioral1/memory/1716-23-0x0000000000320000-0x0000000000644000-memory.dmp	family_quasar
behavioral1/memory/1388-34-0x0000000000B30000-0x0000000000E54000-memory.dmp	family_quasar
behavioral1/memory/2024-45-0x0000000000050000-0x0000000000374000-memory.dmp	family_quasar
behavioral1/memory/908-56-0x00000000010E0000-0x0000000001404000-memory.dmp	family_quasar
behavioral1/memory/1644-137-0x0000000000090000-0x00000000003B4000-memory.dmp	family_quasar
behavioral1/memory/2312-149-0x0000000000F80000-0x00000000012A4000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2368	RuntimeBroker.exe
1716	RuntimeBroker.exe
1388	RuntimeBroker.exe
2024	RuntimeBroker.exe
908	RuntimeBroker.exe
848	RuntimeBroker.exe
1348	RuntimeBroker.exe
2804	RuntimeBroker.exe
764	RuntimeBroker.exe
832	RuntimeBroker.exe
1780	RuntimeBroker.exe
2916	RuntimeBroker.exe
1644	RuntimeBroker.exe
2292	RuntimeBroker.exe
2312	RuntimeBroker.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File created	C:\Windows\system32\a5\RuntimeBroker.exe	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a5\RuntimeBroker.exe	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1736	PING.EXE
580	PING.EXE
2228	PING.EXE
1680	PING.EXE
2836	PING.EXE
2388	PING.EXE
1376	PING.EXE
268	PING.EXE
2480	PING.EXE
1632	PING.EXE
2476	PING.EXE
2604	PING.EXE
2120	PING.EXE
2792	PING.EXE
316	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2388	PING.EXE
2604	PING.EXE
2120	PING.EXE
1632	PING.EXE
2476	PING.EXE
1680	PING.EXE
2480	PING.EXE
316	PING.EXE
268	PING.EXE
2228	PING.EXE
2836	PING.EXE
2792	PING.EXE
1736	PING.EXE
1376	PING.EXE
580	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2176	schtasks.exe
2956	schtasks.exe
2092	schtasks.exe
1852	schtasks.exe
1932	schtasks.exe
2352	schtasks.exe
1920	schtasks.exe
2880	schtasks.exe
3000	schtasks.exe
2324	schtasks.exe
2864	schtasks.exe
2868	schtasks.exe
956	schtasks.exe
2016	schtasks.exe
2084	schtasks.exe
2508	schtasks.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe
Token: SeDebugPrivilege	2368	RuntimeBroker.exe
Token: SeDebugPrivilege	1716	RuntimeBroker.exe
Token: SeDebugPrivilege	1388	RuntimeBroker.exe
Token: SeDebugPrivilege	2024	RuntimeBroker.exe
Token: SeDebugPrivilege	908	RuntimeBroker.exe
Token: SeDebugPrivilege	848	RuntimeBroker.exe
Token: SeDebugPrivilege	1348	RuntimeBroker.exe
Token: SeDebugPrivilege	2804	RuntimeBroker.exe
Token: SeDebugPrivilege	764	RuntimeBroker.exe
Token: SeDebugPrivilege	832	RuntimeBroker.exe
Token: SeDebugPrivilege	1780	RuntimeBroker.exe
Token: SeDebugPrivilege	2916	RuntimeBroker.exe
Token: SeDebugPrivilege	1644	RuntimeBroker.exe
Token: SeDebugPrivilege	2312	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2508	1152	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe	30
PID 1152 wrote to memory of 2508	1152	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe	30
PID 1152 wrote to memory of 2508	1152	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe	30
PID 1152 wrote to memory of 2368	1152	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe	32
PID 1152 wrote to memory of 2368	1152	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe	32
PID 1152 wrote to memory of 2368	1152	4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe	32
PID 2368 wrote to memory of 2880	2368	RuntimeBroker.exe	33
PID 2368 wrote to memory of 2880	2368	RuntimeBroker.exe	33
PID 2368 wrote to memory of 2880	2368	RuntimeBroker.exe	33
PID 2368 wrote to memory of 2836	2368	RuntimeBroker.exe	35
PID 2368 wrote to memory of 2836	2368	RuntimeBroker.exe	35
PID 2368 wrote to memory of 2836	2368	RuntimeBroker.exe	35
PID 2836 wrote to memory of 2732	2836	cmd.exe	37
PID 2836 wrote to memory of 2732	2836	cmd.exe	37
PID 2836 wrote to memory of 2732	2836	cmd.exe	37
PID 2836 wrote to memory of 2604	2836	cmd.exe	38
PID 2836 wrote to memory of 2604	2836	cmd.exe	38
PID 2836 wrote to memory of 2604	2836	cmd.exe	38
PID 2836 wrote to memory of 1716	2836	cmd.exe	40
PID 2836 wrote to memory of 1716	2836	cmd.exe	40
PID 2836 wrote to memory of 1716	2836	cmd.exe	40
PID 1716 wrote to memory of 2352	1716	RuntimeBroker.exe	41
PID 1716 wrote to memory of 2352	1716	RuntimeBroker.exe	41
PID 1716 wrote to memory of 2352	1716	RuntimeBroker.exe	41
PID 1716 wrote to memory of 2052	1716	RuntimeBroker.exe	43
PID 1716 wrote to memory of 2052	1716	RuntimeBroker.exe	43
PID 1716 wrote to memory of 2052	1716	RuntimeBroker.exe	43
PID 2052 wrote to memory of 2308	2052	cmd.exe	45
PID 2052 wrote to memory of 2308	2052	cmd.exe	45
PID 2052 wrote to memory of 2308	2052	cmd.exe	45
PID 2052 wrote to memory of 580	2052	cmd.exe	46
PID 2052 wrote to memory of 580	2052	cmd.exe	46
PID 2052 wrote to memory of 580	2052	cmd.exe	46
PID 2052 wrote to memory of 1388	2052	cmd.exe	47
PID 2052 wrote to memory of 1388	2052	cmd.exe	47
PID 2052 wrote to memory of 1388	2052	cmd.exe	47
PID 1388 wrote to memory of 1932	1388	RuntimeBroker.exe	48
PID 1388 wrote to memory of 1932	1388	RuntimeBroker.exe	48
PID 1388 wrote to memory of 1932	1388	RuntimeBroker.exe	48
PID 1388 wrote to memory of 2500	1388	RuntimeBroker.exe	50
PID 1388 wrote to memory of 2500	1388	RuntimeBroker.exe	50
PID 1388 wrote to memory of 2500	1388	RuntimeBroker.exe	50
PID 2500 wrote to memory of 548	2500	cmd.exe	52
PID 2500 wrote to memory of 548	2500	cmd.exe	52
PID 2500 wrote to memory of 548	2500	cmd.exe	52
PID 2500 wrote to memory of 268	2500	cmd.exe	53
PID 2500 wrote to memory of 268	2500	cmd.exe	53
PID 2500 wrote to memory of 268	2500	cmd.exe	53
PID 2500 wrote to memory of 2024	2500	cmd.exe	54
PID 2500 wrote to memory of 2024	2500	cmd.exe	54
PID 2500 wrote to memory of 2024	2500	cmd.exe	54
PID 2024 wrote to memory of 1920	2024	RuntimeBroker.exe	55
PID 2024 wrote to memory of 1920	2024	RuntimeBroker.exe	55
PID 2024 wrote to memory of 1920	2024	RuntimeBroker.exe	55
PID 2024 wrote to memory of 2280	2024	RuntimeBroker.exe	57
PID 2024 wrote to memory of 2280	2024	RuntimeBroker.exe	57
PID 2024 wrote to memory of 2280	2024	RuntimeBroker.exe	57
PID 2280 wrote to memory of 2140	2280	cmd.exe	59
PID 2280 wrote to memory of 2140	2280	cmd.exe	59
PID 2280 wrote to memory of 2140	2280	cmd.exe	59
PID 2280 wrote to memory of 2228	2280	cmd.exe	60
PID 2280 wrote to memory of 2228	2280	cmd.exe	60
PID 2280 wrote to memory of 2228	2280	cmd.exe	60
PID 2280 wrote to memory of 908	2280	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe
"C:\Users\Admin\AppData\Local\Temp\4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2508
- C:\Windows\system32\a5\RuntimeBroker.exe
  "C:\Windows\system32\a5\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2880
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\bmWaFXNFgqdH.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2732
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2604
  - - C:\Windows\system32\a5\RuntimeBroker.exe
      "C:\Windows\system32\a5\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2352
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NjclsvtOAa4x.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2052
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2308
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:580
      - C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1932
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\HgYZ62gGCv3o.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:548
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:268
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1920
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ECnrABgEM6OI.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2140
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2228
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3000
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\pdEvBjmmKzWi.bat" "
        11⤵
        
        PID:1808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1496
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2480
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:848
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1852
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1HFsx3kvMDyn.bat" "
        13⤵
        
        PID:484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3016
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1680
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2324
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Ax9kHuhEDrHe.bat" "
        15⤵
        
        PID:2072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2120
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\xE6fGAeSyGTN.bat" "
        17⤵
        
        PID:3052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2728
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2836
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:764
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\P0MNMUCpMuHU.bat" "
        19⤵
        
        PID:2632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1816
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2388
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:832
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2868
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\WxcKtO0vMoRM.bat" "
        21⤵
        
        PID:548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2792
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\L5xAfelpdfiZ.bat" "
        23⤵
        
        PID:2140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1632
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\WCwzCoQXEMlR.bat" "
        25⤵
        
        PID:1740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:900
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1736
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2092
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\eUBLNK7sRMDP.bat" "
        27⤵
        
        PID:2424
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1376
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        28⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2016
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\D4dZOybylHF6.bat" "
        29⤵
        
        PID:1148
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:316
        
        C:\Windows\system32\a5\RuntimeBroker.exe
        
        "C:\Windows\system32\a5\RuntimeBroker.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a5\RuntimeBroker.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2084
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\8wMrRd99E0Pb.bat" "
        31⤵
        
        PID:2556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2780
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1HFsx3kvMDyn.bat

Filesize
199B

MD5
fb0cf09d67e0acc315c542526de6d242

SHA1
ede48d48d18d938b5ecefdff5cda224bb32b0012

SHA256
665f5de99fc95f61f5e42358ff406fe9403046fbeab5057e6b5e566d356e4c43

SHA512
dae41f6e407951c6fd0cb81074f5e515114dda2597dc24408ceebf43e67a865a224215895b7eb21ebfcaa920739f9f943d3f8e845dd840c7eb24febcc6a95a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8wMrRd99E0Pb.bat

Filesize
199B

MD5
199be760e15651c7222d8d6fde2fe17f

SHA1
f79d33e1e17580de691b50036920933ec3d90d4f

SHA256
e73a5415eca2e584c1575c3e4da33acbf02c18fdc1c54657a7f9c67a6689f8eb

SHA512
502aa3e65d227e25b71389a3d38c4537584248b814881a8629a08a0ef9664d7b5168080fb4bde93b5a058229c2f647ee2eaa27ec9ea828e1bf44a7d313c7b551

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ax9kHuhEDrHe.bat

Filesize
199B

MD5
213b36e2623ab7f054d2253c4fe42b18

SHA1
e18733b62e584641a6a4963a188090a22b4c23bf

SHA256
baabc70705e49b981e52fde2d5cc8496630f1688ba9d27a48a04e48eeed93a3a

SHA512
a2fc86d3e69f74e448b3b04556d1218d1cbccf2b9698b9b825e0b6bd535b9893374bf02791df3773038b68bc30b05e05282a5e119d7b5bcc4c1df0db1d736261

Download Submit
C:\Users\Admin\AppData\Local\Temp\ECnrABgEM6OI.bat

Filesize
199B

MD5
03dd37285d3e63243f585d52b3df5c30

SHA1
d8ed36b84bb87745bc2c222d8a1c660cee10a6b4

SHA256
453a85ffb9097e601e74cb7b9ac8da8e931e8ae37db6eb1feb910e7b661a1a09

SHA512
92ccd71c992c86275f1dcb18804db5852e4a7eab374cd3f1aa8968351aaf38dc7e7ded4da36c5c628c660a4f753a2f69e69955d8460fd2e7b40c5d7e8d55d284

Download Submit
C:\Users\Admin\AppData\Local\Temp\HgYZ62gGCv3o.bat

Filesize
199B

MD5
209ab2e05df1938c245ed5554512b053

SHA1
6f02e5511343cf448e64e3bf6f889776092da3b9

SHA256
7f40c82217b2abff426c6732b1db2b6cbfc3dec909d543c75e4d225683c09fee

SHA512
deb46505929289ed310efeacd22a437b062115b749ea6244394eb29f7d2973d357c12f10c6f4ef346df907514628dcf034c40df1002015cdf06635afa434a1fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\L5xAfelpdfiZ.bat

Filesize
199B

MD5
bc91bfabe5c594fc715dc159e4c48bd4

SHA1
c8f1513434c3f78811e196a4f12ce9bf2a5f005d

SHA256
584403a5175a786cc84dec0f9418e578c9157e43de738d9ef49c792df61790e3

SHA512
86c000fdaeec1ff340b8832d07dc7dee55d1f99fd40dd927e2715524044fd45e198ab501c3e0ca1ac971d165b0fe207286efe2032362060efd4d556814d4484d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NjclsvtOAa4x.bat

Filesize
199B

MD5
83a239ecc915eb4e9a16691ae7bde1c9

SHA1
a0ce213901257881fd041a145b6ff351f0c7d878

SHA256
4d345b3e0344f7ae548c06245b5ba170ea519149bc2da9f70a651474dadaf9c4

SHA512
e170bab7d01da6ff20eea68c30d985bdb15e6776c636cebf2e49324a73f9a9d03d4fcc4127f2fd24a9ab007a6884741b29ab21bf13e18a11c6acfadfcaddd2e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0MNMUCpMuHU.bat

Filesize
199B

MD5
346bd1b9196d0d843afb7d84898fc01b

SHA1
03e4bfaef32480e8eea503ea0d811f034f50548c

SHA256
8f028606d69674815b1b4172eeb9fc13ec2cf3aedff33ef04dffb5e2879e2f9e

SHA512
bd6244c4d2f9e1bdff20c9c9776017eceac231c78df961cb910da40e620a2f586f25b51f77847af84a5dff3167cf2abd9d20a35c9afd05fb6a4ebf139f3301dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WCwzCoQXEMlR.bat

Filesize
199B

MD5
35bc7429932c5088cbc4b2f796814deb

SHA1
8b977ad1797e8982e55f96a757125323ea13c0af

SHA256
cee139cf53d0818e564a130aae5b6e8a89844f154c14455a16bec03e4c737d9b

SHA512
1a7d36bba23f79c5d777182e8d9681c59136d7f6c83a2965c63f025f9e6c88653bb1f0e2c255c0cba99f460990e407c6bc3b1f0e70e794c18f268e1f48054929

Download Submit
C:\Users\Admin\AppData\Local\Temp\WxcKtO0vMoRM.bat

Filesize
199B

MD5
fdde78d709781a2543965573ab52fb67

SHA1
f2e5f8aa622478fba523d37ff01c9fd3c6061875

SHA256
2d6b4e18072ea0f7220c475786f77f344d6deb98110bb4b81f3affb6483c8045

SHA512
5cbef0cc32820e1165d3eca85a586291d45ea2478c350681d7518531544d337d3bf8ec291e9ce48438dcbdf0fef70e720679b0a9c7673dc692a9a9b01d6f01f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\bmWaFXNFgqdH.bat

Filesize
199B

MD5
2d8781a8aabe68330464397514ed5e02

SHA1
cda86b85dc1da3eb944f9208afcd394777c59e8d

SHA256
5ad7b8f37e6eec249ea7f5d16684540b247f17715c91a63190b6224f5abedb65

SHA512
dfca7a90f061a3ac3e494cd4ccdb69e6d6c05e14e37b75480f060aae317a3bcb38877c312ae18b69a927ed1e5b990f7f2dca3d69cee37526e2ba08c487ac8a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\eUBLNK7sRMDP.bat

Filesize
199B

MD5
942c490c1ae87ea915e40bb0aae566c4

SHA1
f375cb0162ece5c230044a6c5bdae94bdacba22a

SHA256
8cdab377849e68db75b2e3317d7e141a7baf6571bd21fffb7e287d719e6241df

SHA512
4c4f32a4405b5c04556e049347a95555e2311c7d9cc8d47e1f5cc941a77c604f2c394da2ad6f768008a3379c7d1578542830e001630d627fb49bf90184442c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdEvBjmmKzWi.bat

Filesize
199B

MD5
8b3a4ccad8c54269c51de5c37e766a5c

SHA1
5d04e87b722ea77a069936b7ab27f72cd1b7b5ad

SHA256
a6e057c22141cd7882325e353085d424fc379096a3ce7e6cdaba1c1c5c45c007

SHA512
12157069dafde8f372397409887a652331c58b16c5458161cf12d4198895d2e8453b5cb9b56372dba5fb83a286a275f3671ec783c98ef02f3dfef69ae7b6c7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\xE6fGAeSyGTN.bat

Filesize
199B

MD5
8bf2bbb83574430f3a9b126351933f81

SHA1
e193e2fc259dcb64bad76db7e2a958ccba12015a

SHA256
c394ee16e475c2a0570f08afcfc482109c5f1752e19fcebbb103770557146726

SHA512
3444c6518f89f09dd9275e866185c4e33d56c74ed50db8b3a56ee9524da937d88c87503fdd1accfda40cf2c83bb9924e518bc09f1e46ad755dfc2c5fb44f48cc

Download Submit
C:\Windows\System32\a5\RuntimeBroker.exe

Filesize
3.1MB

MD5
bdec971d6eb3ebfa2000191a40525746

SHA1
59f362a302cd3fba7c10c16ffac83eb2f099104f

SHA256
4e2877d8f39535f2a6073174952795bb2f7587f4343a8c449b64cc211ee683bd

SHA512
c8a7e7bc180c6634732b3e4f42cc5029523882348d43272ac598f6640b9fb927b302ba2f35933e3c21efb77a1e902e66791a08a3fdc3b2677b15e306f4c664cd

Download Submit
memory/908-56-0x00000000010E0000-0x0000000001404000-memory.dmp

Filesize
3.1MB

Download
memory/1152-8-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/1152-0-0x000007FEF5CD3000-0x000007FEF5CD4000-memory.dmp

Filesize
4KB

Download
memory/1152-2-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/1152-1-0x00000000009D0000-0x0000000000CF4000-memory.dmp

Filesize
3.1MB

Download
memory/1388-34-0x0000000000B30000-0x0000000000E54000-memory.dmp

Filesize
3.1MB

Download
memory/1644-137-0x0000000000090000-0x00000000003B4000-memory.dmp

Filesize
3.1MB

Download
memory/1716-23-0x0000000000320000-0x0000000000644000-memory.dmp

Filesize
3.1MB

Download
memory/2024-45-0x0000000000050000-0x0000000000374000-memory.dmp

Filesize
3.1MB

Download
memory/2312-149-0x0000000000F80000-0x00000000012A4000-memory.dmp

Filesize
3.1MB

Download
memory/2368-20-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-10-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-11-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-9-0x0000000000150000-0x0000000000474000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads