quasar | 74f9ecaca138f44b8e4ea36b50ca44c026c52c15d73209db1634c788064fb11c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RuntimeBroker.exe
Size 3.1MB
Sample260601-wpxvsady6q
SHA256 74f9ecaca138f44b8e4ea36b50ca44c026c52c15d73209db1634c788064fb11c
MD5 f5e8113765d2aa43b75854c357e33243
SHA1 0cd23d9812b504ef70331ac9adb09f848dbb0916
SHA512 72f8f71af464fbe4194db1b332879420577368616344a2a2ba7ea2efd24acfcb42e5a90504cba3d136be57d49fe66dd60dad9927ba0b689e618a45a5ae068fc4
SSDEEP 49152:3vVuf2NUaNmwzPWlvdaKM7ZxTwicgrvMzvJDVoGdN5THHB72eh2NT:3vgf2NUaNmwzPWlvdaB7ZxTwMMj
TLSH
T1AAE55A143BF85E32E16AE6B3D5B0501663F1F82AF363EB1B2181677E1C53B505C426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

runtime broker discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Runtime Broker

dadfsfsdfasdfasddfgssdfaafsd-34593.portmap.host:34593

Mutex

b4fbe472-65c8-481b-918d-98e28a1daa6a

Attributes

encryption_key
5B27051D67AA2CCE9314596003B68709A13FC003
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Runtime Broker
subdirectory
discord

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1516-0-0x0000000000430000-0x0000000000754000-memory.dmp	family_quasar
behavioral2/files/0x000700000002a95a-3.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2432	Client.exe
772	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3772	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3772	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2952	schtasks.exe
3268	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	RuntimeBroker.exe
Token: SeDebugPrivilege	2432	Client.exe
Token: SeDebugPrivilege	772	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	Client.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2952	1516	RuntimeBroker.exe	82
PID 1516 wrote to memory of 2432	1516	RuntimeBroker.exe	84
PID 2432 wrote to memory of 3268	2432	Client.exe	86
PID 2432 wrote to memory of 4736	2432	Client.exe	91
PID 2432 wrote to memory of 3156	2432	Client.exe	93
PID 3156 wrote to memory of 1696	3156	cmd.exe	95
PID 3156 wrote to memory of 3772	3156	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\discord\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2952
- C:\Users\Admin\AppData\Roaming\discord\Client.exe
  "C:\Users\Admin\AppData\Roaming\discord\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\discord\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3268
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /delete /tn "Runtime Broker" /f
    3⤵
    PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MZ2TJzeedwub.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1696
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3772

C:\Users\Admin\AppData\Roaming\discord\Client.exe
C:\Users\Admin\AppData\Roaming\discord\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

MZ2TJzeedwub.bat

Path C:\Users\Admin\AppData\Local\Temp\MZ2TJzeedwub.bat
Size 212B
SHA256 938407b917f284504a0434a553f32e6809f37aa25df29ec5b6def679f8c8bb51
MD5 af6879bedce735c29f87802d2afe0f61
SHA1 04c00d7ecdfb34b327ec55fe3afa38823aa19f11
SHA512 046a9308a29ce5932aae5f95c0d53b393a423038bed079ebfcc7a68bb30f51cc9f55adfd340a7057dbd8e33292231ef0da0d61966fa8318edb6fc44c9f3dc2f4
TLSH
T161D023132341C65C4505444B59E5B2CC609E4CF61F0DBDF2490188DC83C586C6567AC3
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\discord\Client.exe
Size 3.1MB
SHA256 74f9ecaca138f44b8e4ea36b50ca44c026c52c15d73209db1634c788064fb11c
MD5 f5e8113765d2aa43b75854c357e33243
SHA1 0cd23d9812b504ef70331ac9adb09f848dbb0916
SHA512 72f8f71af464fbe4194db1b332879420577368616344a2a2ba7ea2efd24acfcb42e5a90504cba3d136be57d49fe66dd60dad9927ba0b689e618a45a5ae068fc4
SSDEEP 49152:3vVuf2NUaNmwzPWlvdaKM7ZxTwicgrvMzvJDVoGdN5THHB72eh2NT:3vgf2NUaNmwzPWlvdaB7ZxTwMMj
TLSH
T1AAE55A143BF85E32E16AE6B3D5B0501663F1F82AF363EB1B2181677E1C53B505C426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1516-0-0x0000000000430000-0x0000000000754000-memory.dmp

Download

memory/2432-6-0x000000001C680000-0x000000001C690000-memory.dmp

Download

memory/2432-9-0x000000001CE40000-0x000000001CEF2000-memory.dmp

Download

memory/2432-8-0x000000001B830000-0x000000001B880000-memory.dmp

Download

memory/2432-11-0x000000001C680000-0x000000001C690000-memory.dmp

Download

memory/2432-12-0x000000001C660000-0x000000001C672000-memory.dmp

Download

memory/2432-13-0x000000001CDC0000-0x000000001CDFC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads