Windows Analysis Report
RuntimeBroker.exe

AI detected suspicious sample

Source: Yara match	File source: RuntimeBroker.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1253737439.00000000001E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\System32\a7\RuntimeBroker.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: RuntimeBroker.exe

Joe Sandbox ML: detected

Source: RuntimeBroker.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RuntimeBroker.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: qrpn9be.localto.net

Yara detected Generic Downloader

Source: Yara match	File source: RuntimeBroker.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.7:49699 -> 116.203.56.216:2810

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: qrpn9be.localto.net

Source: RuntimeBroker.exe, 00000000.00000002.1281888976.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000008.00000002.2502388807.0000000002ED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RuntimeBroker.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://api.ipify.org/
Source: RuntimeBroker.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://ipwho.is/
Source: RuntimeBroker.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: RuntimeBroker.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: RuntimeBroker.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\System32\a7\RuntimeBroker.exe

Windows user hook set: 0 keyboard low level C:\Windows\system32\a7\RuntimeBroker.exe

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: RuntimeBroker.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1253737439.00000000001E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED

System Summary

Source: RuntimeBroker.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: RuntimeBroker.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: RuntimeBroker.exe, type: SAMPLE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: C:\Users\user\Desktop\RuntimeBroker.exe	File created: C:\Windows\system32\a7			Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	File created: C:\Windows\system32\a7\RuntimeBroker.exe			Jump to behavior

Source: C:\Windows\System32\a7\RuntimeBroker.exe	Code function: 8_2_00007FFAAC393C6F	8_2_00007FFAAC393C6F
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Code function: 8_2_00007FFAAC6054E5	8_2_00007FFAAC6054E5
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Code function: 8_2_00007FFAAC609271	8_2_00007FFAAC609271
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Code function: 8_2_00007FFAAC60AFDD	8_2_00007FFAAC60AFDD
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Code function: 8_2_00007FFAAC609BD1	8_2_00007FFAAC609BD1
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Code function: 8_2_00007FFAAC60621F	8_2_00007FFAAC60621F

Source: RuntimeBroker.exe, 00000000.00000000.1254084634.0000000000500000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename" vs RuntimeBroker.exe
Source: RuntimeBroker.exe, 00000008.00000002.2500829834.0000000000E00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RuntimeBroker.exe
Source: RuntimeBroker.exe	Binary or memory string: OriginalFilename" vs RuntimeBroker.exe
Source: RuntimeBroker.exe.0.dr	Binary or memory string: OriginalFilename" vs RuntimeBroker.exe

Source: RuntimeBroker.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RuntimeBroker.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: RuntimeBroker.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: RuntimeBroker.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/2@1/1

Source: C:\Users\user\Desktop\RuntimeBroker.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Source: C:\Windows\System32\a7\RuntimeBroker.exe	Mutant created: NULL
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\fc5edab1-6e8f-4963-98aa-bd077e08750f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03

Source: RuntimeBroker.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RuntimeBroker.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\RuntimeBroker.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RuntimeBroker.exe

ReversingLabs: Detection: 78%

Source: RuntimeBroker.exe

String found in binary or memory: HasSubValue3Conflicting item/add type

Source: C:\Users\user\Desktop\RuntimeBroker.exe

File read: C:\Users\user\Desktop\RuntimeBroker.exe

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown	Process created: C:\Users\user\Desktop\RuntimeBroker.exe "C:\Users\user\Desktop\RuntimeBroker.exe"
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process created: C:\Windows\System32\a7\RuntimeBroker.exe "C:\Windows\system32\a7\RuntimeBroker.exe"
Source: unknown	Process created: C:\Windows\System32\a7\RuntimeBroker.exe C:\Windows\system32\a7\RuntimeBroker.exe
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process created: C:\Windows\System32\a7\RuntimeBroker.exe "C:\Windows\system32\a7\RuntimeBroker.exe"	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: RuntimeBroker.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RuntimeBroker.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: RuntimeBroker.exe

Static file information: File size 3265536 > 1048576

Source: RuntimeBroker.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c400

Source: RuntimeBroker.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\a7\RuntimeBroker.exe

Code function: 8_2_00007FFAAC60336E push eax; ret

8_2_00007FFAAC60340C

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\RuntimeBroker.exe

Executable created and started: C:\Windows\system32\a7\RuntimeBroker.exe

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\RuntimeBroker.exe

File created: C:\Windows\System32\a7\RuntimeBroker.exe

Jump to dropped file

Source: C:\Users\user\Desktop\RuntimeBroker.exe

File created: C:\Windows\System32\a7\RuntimeBroker.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\RuntimeBroker.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\RuntimeBroker.exe	File opened: C:\Users\user\Desktop\RuntimeBroker.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	File opened: C:\Windows\system32\a7\RuntimeBroker.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	File opened: C:\Windows\system32\a7\RuntimeBroker.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\RuntimeBroker.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Memory allocated: 1A8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Memory allocated: 1390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Memory allocated: 1AEA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Memory allocated: 29B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Memory allocated: 1A9B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\a7\RuntimeBroker.exe

Code function: 8_2_00007FFAAC39F1F2 str ax

8_2_00007FFAAC39F1F2

Source: C:\Users\user\Desktop\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\a7\RuntimeBroker.exe	Window / User API: threadDelayed 2150			Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Window / User API: threadDelayed 7693			Jump to behavior

Source: C:\Users\user\Desktop\RuntimeBroker.exe TID: 6672	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe TID: 7320	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe TID: 7320	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe TID: 7336	Thread sleep count: 2150 > 30	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe TID: 7336	Thread sleep count: 7693 > 30	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe TID: 1008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RuntimeBroker.exe, 00000008.00000002.2508354895.000000001BA0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\RuntimeBroker.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\RuntimeBroker.exe	Process created: C:\Windows\System32\a7\RuntimeBroker.exe "C:\Windows\system32\a7\RuntimeBroker.exe"	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\RuntimeBroker.exe	Queries volume information: C:\Users\user\Desktop\RuntimeBroker.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Queries volume information: C:\Windows\System32\a7\RuntimeBroker.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\a7\RuntimeBroker.exe	Queries volume information: C:\Windows\System32\a7\RuntimeBroker.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RuntimeBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: RuntimeBroker.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1253737439.00000000001E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: RuntimeBroker.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RuntimeBroker.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1253737439.00000000001E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\a7\RuntimeBroker.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	121 Masquerading	11 Input Capture	11 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	41 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
RuntimeBroker.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1307453
RuntimeBroker.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\System32\a7\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1307453
C:\Windows\System32\a7\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Windows\System32\a7\RuntimeBroker.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar

Source	Detection	Scanner	Label	Link
qrpn9be.localto.net	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
qrpn9be.localto.net	116.203.56.216	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
qrpn9be.localto.net	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org/	RuntimeBroker.exe, RuntimeBroker.exe.0.dr	false	high
https://stackoverflow.com/q/14436606/23354	RuntimeBroker.exe, RuntimeBroker.exe.0.dr	false	high
https://stackoverflow.com/q/2152978/23354sCannot	RuntimeBroker.exe, RuntimeBroker.exe.0.dr	false	high
https://ipwho.is/	RuntimeBroker.exe, RuntimeBroker.exe.0.dr	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RuntimeBroker.exe, 00000000.00000002.1281888976.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000008.00000002.2502388807.0000000002ED9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	RuntimeBroker.exe, RuntimeBroker.exe.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.203.56.216	qrpn9be.localto.net	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574481
Start date and time:	2024-12-13 11:11:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RuntimeBroker.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/2@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 27 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RuntimeBroker.exe, PID 3180 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: RuntimeBroker.exe

Simulations

Behavior and APIs

Time	Type	Description
05:12:32	API Interceptor	2704592x Sleep call for process: RuntimeBroker.exe modified
11:12:29	Task Scheduler	Run new task: RuntimeBroker path: C:\Windows\system32\a7\RuntimeBroker.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
116.203.56.216	Fattura (3).jar	Get hash	malicious	Unknown	Browse
	Fattura (4).jar	Get hash	malicious	Unknown	Browse
	Fattura (3).jar	Get hash	malicious	Unknown	Browse
	Fattura (4).jar	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	fmfZgt6Wzl.exe	Get hash	malicious	Unknown	Browse	188.40.187.174
	fmfZgt6Wzl.exe	Get hash	malicious	Unknown	Browse	188.40.187.174
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	116.203.10.31
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	116.203.10.31
	jade.arm.elf	Get hash	malicious	Mirai	Browse	95.217.252.214
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	116.203.10.31
	http://www.pej935.pro/Ume-ZD~Hl_1c0e5b67/C/	Get hash	malicious	Unknown	Browse	78.46.22.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	116.203.10.31
	file.exe	Get hash	malicious	Unknown	Browse	188.40.187.174
	file.exe	Get hash	malicious	Vidar	Browse	116.203.10.31

Process:	C:\Users\user\Desktop\RuntimeBroker.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Windows\System32\a7\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\RuntimeBroker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3265536
Entropy (8bit):	6.083531762679813
Encrypted:	false
SSDEEP:	49152:uvHI22SsaNYfdPBldt698dBcjH/N/9oGduTHHB72eh2NT:uvo22SsaNYfdPBldt6+dBcjH/Nl
MD5:	57145C33045CE67E1C1FE7C763438AB1
SHA1:	2A83ECEF8BBE640577A2CC3F6602BBD8E7D6C847
SHA-256:	9764BC832BFA8A9F3D7AF1EA6747E7376774BD903E9CC545D9998F2657E97FA3
SHA-512:	7CE3D6DBD3C3B05FF6FE1AC57888123CF5E01E890C5B5E7204859B361841D15FDB8A460626355236B9C3DF58824CB1979C187F34FA6D7D282517023F3A26A112
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: ditekshen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@2...........@...................................1.K.....2.<.................... 2...................................................... ............... ..H............text.....1.. ....1................. ..`.rsrc...<.....2.......1.............@..@.reloc....... 2.......1.............@..B..................1.....H........................k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.083531762679813
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	RuntimeBroker.exe
File size:	3'265'536 bytes
MD5:	57145c33045ce67e1c1fe7c763438ab1
SHA1:	2a83ecef8bbe640577a2cc3f6602bbd8e7d6c847
SHA256:	9764bc832bfa8a9f3d7af1ea6747e7376774bd903e9cc545d9998f2657e97fa3
SHA512:	7ce3d6dbd3c3b05ff6fe1ac57888123cf5e01e890c5b5e7204859b361841d15fdb8a460626355236b9c3df58824cb1979c187f34fa6d7d282517023f3a26a112
SSDEEP:	49152:uvHI22SsaNYfdPBldt698dBcjH/N/9oGduTHHB72eh2NT:uvo22SsaNYfdPBldt6+dBcjH/Nl
TLSH:	30E56A0437F85E76E16BE6B7D5B1501263F0F82AF363EB1B2581A77A1C53B4088426B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@2...........@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x71e3ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x640DFAE7 [Sun Mar 12 16:16:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31e3a0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x320000	0xa3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x322000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x31c3f4	0x31c400	49668a9fef0a063df3f977c654b3718a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x320000	0xa3c	0xc00	a5935f834a4ded3b46b17b880023c905	False	0.3505859375	data	5.260153502397429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x322000	0xc	0x200	221440a5d95d2d9aec29428c5700ca78	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3200a0	0x2c4	data			0.4279661016949153
RT_MANIFEST	0x320364	0x6d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text			0.40319817247287265

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 11:12:33.166569948 CET	49699	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:33.286462069 CET	2810	49699	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:33.286556959 CET	49699	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:33.296344995 CET	49699	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:33.417001009 CET	2810	49699	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:35.486979961 CET	2810	49699	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:35.487083912 CET	49699	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:35.504044056 CET	49699	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:35.624028921 CET	2810	49699	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:39.153172970 CET	49706	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:39.273540020 CET	2810	49706	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:39.273786068 CET	49706	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:39.274085045 CET	49706	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:39.394032955 CET	2810	49706	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:41.488672018 CET	2810	49706	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:41.488859892 CET	49706	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:41.489423990 CET	49706	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:41.609385967 CET	2810	49706	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:45.043689013 CET	49724	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:45.163528919 CET	2810	49724	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:45.163629055 CET	49724	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:45.164153099 CET	49724	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:45.287398100 CET	2810	49724	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:47.362433910 CET	2810	49724	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:47.362519979 CET	49724	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:47.363009930 CET	49724	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:47.482867002 CET	2810	49724	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:50.826415062 CET	49737	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:50.947366953 CET	2810	49737	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:50.947601080 CET	49737	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:50.948081970 CET	49737	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:51.118807077 CET	2810	49737	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:53.158554077 CET	2810	49737	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:53.158864021 CET	49737	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:53.166846037 CET	49737	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:53.286705971 CET	2810	49737	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:56.793802023 CET	49753	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:56.914056063 CET	2810	49753	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:56.914513111 CET	49753	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:56.914743900 CET	49753	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:57.034558058 CET	2810	49753	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:59.110908985 CET	2810	49753	116.203.56.216	192.168.2.7
Dec 13, 2024 11:12:59.112067938 CET	49753	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:59.112588882 CET	49753	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:12:59.232309103 CET	2810	49753	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:02.856192112 CET	49769	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:02.976063013 CET	2810	49769	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:02.976239920 CET	49769	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:02.976640940 CET	49769	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:03.096579075 CET	2810	49769	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:05.176023960 CET	2810	49769	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:05.176129103 CET	49769	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:05.176501989 CET	49769	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:05.296329975 CET	2810	49769	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:08.918971062 CET	49777	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:09.038880110 CET	2810	49777	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:09.039331913 CET	49777	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:09.039638042 CET	49777	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:09.159384012 CET	2810	49777	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:11.236416101 CET	2810	49777	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:11.236680031 CET	49777	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:11.237070084 CET	49777	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:11.356899977 CET	2810	49777	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:14.528367043 CET	49792	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:14.649251938 CET	2810	49792	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:14.649471998 CET	49792	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:14.649857044 CET	49792	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:14.769704103 CET	2810	49792	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:16.895025015 CET	2810	49792	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:16.895548105 CET	49792	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:16.896915913 CET	49792	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:17.017967939 CET	2810	49792	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:20.497463942 CET	49807	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:20.617446899 CET	2810	49807	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:20.617665052 CET	49807	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:20.618078947 CET	49807	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:20.737998962 CET	2810	49807	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:22.815105915 CET	2810	49807	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:22.815323114 CET	49807	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:22.815656900 CET	49807	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:22.935384035 CET	2810	49807	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:26.169122934 CET	49820	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:26.289225101 CET	2810	49820	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:26.289346933 CET	49820	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:26.296330929 CET	49820	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:26.416162968 CET	2810	49820	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:28.503297091 CET	2810	49820	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:28.503523111 CET	49820	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:28.503874063 CET	49820	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:28.623548985 CET	2810	49820	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:32.001368046 CET	49836	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:32.121031046 CET	2810	49836	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:32.121148109 CET	49836	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:32.121639967 CET	49836	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:32.241302013 CET	2810	49836	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:34.313863039 CET	2810	49836	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:34.313955069 CET	49836	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:34.314469099 CET	49836	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:34.434331894 CET	2810	49836	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:37.411252975 CET	49847	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:37.531425953 CET	2810	49847	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:37.531924009 CET	49847	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:37.531924963 CET	49847	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:37.651866913 CET	2810	49847	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:39.737721920 CET	2810	49847	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:39.737831116 CET	49847	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:39.738260984 CET	49847	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:39.858295918 CET	2810	49847	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:42.856878042 CET	49863	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:42.976830959 CET	2810	49863	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:42.977010012 CET	49863	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:42.977406979 CET	49863	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:43.097254038 CET	2810	49863	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:45.173264027 CET	2810	49863	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:45.173588037 CET	49863	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:45.174223900 CET	49863	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:45.294125080 CET	2810	49863	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:47.918979883 CET	49874	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:48.038887978 CET	2810	49874	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:48.039062977 CET	49874	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:48.039428949 CET	49874	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:48.159157038 CET	2810	49874	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:50.286060095 CET	2810	49874	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:50.288091898 CET	49874	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:50.288415909 CET	49874	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:50.408571959 CET	2810	49874	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:52.700146914 CET	49885	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:52.820055962 CET	2810	49885	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:52.822437048 CET	49885	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:52.857377052 CET	49885	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:52.977619886 CET	2810	49885	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:55.104176998 CET	2810	49885	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:55.104300022 CET	49885	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:55.104667902 CET	49885	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:55.224381924 CET	2810	49885	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:56.981471062 CET	49896	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:57.101255894 CET	2810	49896	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:57.102195024 CET	49896	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:57.102519035 CET	49896	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:57.222381115 CET	2810	49896	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:59.299657106 CET	2810	49896	116.203.56.216	192.168.2.7
Dec 13, 2024 11:13:59.299781084 CET	49896	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:59.300173998 CET	49896	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:13:59.419928074 CET	2810	49896	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:01.185152054 CET	49907	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:01.327330112 CET	2810	49907	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:01.327552080 CET	49907	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:01.328075886 CET	49907	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:01.554662943 CET	2810	49907	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:03.535824060 CET	2810	49907	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:03.536034107 CET	49907	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:03.536628962 CET	49907	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:03.656352043 CET	2810	49907	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:04.965936899 CET	49918	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:05.086970091 CET	2810	49918	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:05.087249041 CET	49918	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:05.087529898 CET	49918	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:05.207281113 CET	2810	49918	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:07.302803993 CET	2810	49918	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:07.304059982 CET	49918	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:07.307334900 CET	49918	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:07.427265882 CET	2810	49918	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:08.763326883 CET	49927	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:08.883914948 CET	2810	49927	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:08.884085894 CET	49927	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:08.921669960 CET	49927	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:09.048115969 CET	2810	49927	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:11.083297014 CET	2810	49927	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:11.083511114 CET	49927	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:11.083945036 CET	49927	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:11.203800917 CET	2810	49927	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:12.278461933 CET	49935	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:12.398595095 CET	2810	49935	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:12.398672104 CET	49935	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:12.399172068 CET	49935	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:12.519607067 CET	2810	49935	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:14.607271910 CET	2810	49935	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:14.607335091 CET	49935	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:14.607871056 CET	49935	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:14.727550030 CET	2810	49935	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:15.747406960 CET	49945	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:15.867872953 CET	2810	49945	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:15.868007898 CET	49945	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:15.871409893 CET	49945	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:15.991298914 CET	2810	49945	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:18.081826925 CET	2810	49945	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:18.081954956 CET	49945	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:18.084103107 CET	49945	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:18.203855991 CET	2810	49945	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:18.966212988 CET	49952	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:19.085892916 CET	2810	49952	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:19.085999012 CET	49952	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:19.087354898 CET	49952	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:19.207075119 CET	2810	49952	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:21.284100056 CET	2810	49952	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:21.284219980 CET	49952	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:21.285500050 CET	49952	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:21.405201912 CET	2810	49952	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:22.123275042 CET	49961	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:22.243554115 CET	2810	49961	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:22.244273901 CET	49961	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:22.247112989 CET	49961	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:22.368947029 CET	2810	49961	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:24.439346075 CET	2810	49961	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:24.439419031 CET	49961	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:24.439927101 CET	49961	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:24.559712887 CET	2810	49961	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:25.185298920 CET	49969	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:25.673399925 CET	2810	49969	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:25.673609018 CET	49969	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:25.674145937 CET	49969	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:25.802895069 CET	2810	49969	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:27.879395008 CET	2810	49969	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:27.879502058 CET	49969	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:27.879934072 CET	49969	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:28.000076056 CET	2810	49969	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:28.560199976 CET	49976	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:28.681864023 CET	2810	49976	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:28.681952000 CET	49976	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:28.682492971 CET	49976	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:28.802521944 CET	2810	49976	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:30.879374027 CET	2810	49976	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:30.879446030 CET	49976	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:30.879735947 CET	49976	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:31.000765085 CET	2810	49976	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:31.451172113 CET	49985	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:31.571362019 CET	2810	49985	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:31.571969032 CET	49985	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:31.572339058 CET	49985	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:31.692013979 CET	2810	49985	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:33.776009083 CET	2810	49985	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:33.776194096 CET	49985	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:33.776546001 CET	49985	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:33.896600962 CET	2810	49985	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:37.434509993 CET	49995	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:37.554363012 CET	2810	49995	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:37.554522991 CET	49995	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:37.554862976 CET	49995	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:37.674629927 CET	2810	49995	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:39.819024086 CET	2810	49995	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:39.819520950 CET	49995	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:39.819674015 CET	49995	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:39.939565897 CET	2810	49995	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:43.309624910 CET	49996	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:43.429689884 CET	2810	49996	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:43.429903030 CET	49996	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:43.430210114 CET	49996	2810	192.168.2.7	116.203.56.216
Dec 13, 2024 11:14:43.549988985 CET	2810	49996	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:45.638052940 CET	2810	49996	116.203.56.216	192.168.2.7
Dec 13, 2024 11:14:45.638761997 CET	49996	2810	192.168.2.7	116.203.56.216

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 11:12:32.594563961 CET	61484	53	192.168.2.7	1.1.1.1
Dec 13, 2024 11:12:33.154680967 CET	53	61484	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 11:12:32.594563961 CET	192.168.2.7	1.1.1.1	0xdaed	Standard query (0)	qrpn9be.localto.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 11:12:33.154680967 CET	1.1.1.1	192.168.2.7	0xdaed	No error (0)	qrpn9be.localto.net		116.203.56.216	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:12:26
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RuntimeBroker.exe"
Imagebase:	0x1e0000
File size:	3'265'536 bytes
MD5 hash:	57145C33045CE67E1C1FE7C763438AB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1253737439.00000000001E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	05:12:28
Start date:	13/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
Imagebase:	0x7ff7c5760000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	05:12:28
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	05:12:28
Start date:	13/12/2024
Path:	C:\Windows\System32\a7\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\a7\RuntimeBroker.exe"
Imagebase:	0x750000
File size:	3'265'536 bytes
MD5 hash:	57145C33045CE67E1C1FE7C763438AB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Windows\System32\a7\RuntimeBroker.exe, Author: ditekshen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	05:12:29
Start date:	13/12/2024
Path:	C:\Windows\System32\a7\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\a7\RuntimeBroker.exe
Imagebase:	0x2d0000
File size:	3'265'536 bytes
MD5 hash:	57145C33045CE67E1C1FE7C763438AB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	05:12:30
Start date:	13/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
Imagebase:	0x7ff7c5760000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	05:12:30
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true