Edit tour

Windows Analysis Report
2Mi3lKoJfj.exe

Overview

General Information

Sample name:	2Mi3lKoJfj.exe renamed because original name is a hash value
Original sample name:	b94af11cca65c557d23559e978a49d18.exe
Analysis ID:	1583601
MD5:	b94af11cca65c557d23559e978a49d18
SHA1:	0c3436d0c5df8e2e39bf4869bbe4413ca8d594b7
SHA256:	f6a0a782d574de811fe66ecf6416c69b486f9ca20faf96cfc863a00063306338
Tags:	exeQuasarRATRATuser-abuse_ch
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses schtasks.exe or at.exe to add and modify task schedules

Uses shutdown.exe to shutdown or reboot the system

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to detect virtual machines (STR)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Execution of Shutdown

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

2Mi3lKoJfj.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\2Mi3lKoJfj.exe" MD5: B94AF11CCA65C557D23559E978A49D18)

schtasks.exe (PID: 7328 cmdline: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RuntimeBroker.exe (PID: 7420 cmdline: "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" MD5: B94AF11CCA65C557D23559E978A49D18)

schtasks.exe (PID: 7472 cmdline: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

shutdown.exe (PID: 7672 cmdline: "C:\Windows\System32\shutdown.exe" /s /t 0 MD5: F2A4E18DA72BB2C5B21076A5DE382A20)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

shutdown.exe (PID: 8028 cmdline: "C:\Windows\System32\shutdown.exe" /s /t 0 MD5: F2A4E18DA72BB2C5B21076A5DE382A20)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RuntimeBroker.exe (PID: 7448 cmdline: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe MD5: B94AF11CCA65C557D23559E978A49D18)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "194.26.192.167:2768;", "SubDirectory": "RuntimeBroker", "InstallName": "RuntimeBroker.exe", "MutexName": "859d5f90-e2d0-4b2d-ba9f-5371df032ec2", "StartupKey": "RuntimeBroker", "LogDirectoryName": "Logs", "ServerSignature": "HLslqQCNhdORmt9FCkAoRZrPsL/QZ+X7L5BYCTwyjm+j0iRcqsXqSMBfjKaA0Z/VsXvYHImcNHtGPMZtFagEfGGsJYPbzXbkf3bmRGyrX2KjSu21OB4r/BrzkxWemrgblEj7tj3Y9suDtBtkRspLl3wICM1YJI4WF5dGSHgO3O28feawR8uCUuw8s95M470IepEqdwNbtYXzdtXfjNj6zQg8Eo0irBdcUB9eNuRVK8DeoMeer8ueo9HviqpSea31UwRMcLWq7EFFBLPAXSqpqg3G+qxE14o4wmdEHOwlFynUpEtiRkrdeIX89V+JIeue321yPIIt1PrQHqGp87c7BsOkaBTYZg7Pk104uKe/zWShInSWuvv0cc04ndks+SknWEjAJFoe6kGaTnEaa5bv8QiJ91McGOFEPJQhMyFnBlWiVeMEyro7LwGxg9QugfOmvOH3jNEb+EP4p+nNm/ywWgBWsSNTfrUyiBDGFNMqBG3Q5ObAvUHmJV/q5GxnJrgFN2wAL3CHP71RESbg8bTr8aMvv7wG5ih8ORKB8rrw41KPbosFIjjj1C/KKddXMW5E3K15+yZFqb7p/oeFiWJit3g0ETP7WskoSWzLqRAOV9A4tVX+LgEgv4pSmQE+x85dt80GcFPVHEUTTtYx+fCXD9Ux5n8b2GnSgBxQHYzhrLw=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANsXKsVBNY84Mxn9yL1q+zANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIyMjIxNDAwMloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApZBonJM7WYHmpm3qdrgPzvZzjN2KhDm7b6/Ed/STVeygNnLFcWZRg3SlTelP9JyCVSduUTu3rnUGjKv6Yy93iBREBOLUjz//kG9XFcu1bC7kspcUZsXwWvh4oTpK5TYTvNv+S33iVxkTFF1X2irKFrw1JqX+iTC8Gs7kzh6lD1oBzg8dCxiq1ztmOsvY4KF0/AeOr/1lVNT43QD+Mz0YgLOrAP88SIvZ6uSEKRpDJGHWMrDdvICjhDrH4G7sdT1lJyZfOqWKj3LjZfL9hKh1PZYRKlyoH764Y7J5LqqyyrBlr36kLdNoEYCHvywePknU5CS5024n73ozNQBIN1uf/gUjBOTbg6QMZLpN0TwI0TA+z2uEejwDvRZLi+nHdtsiIGfGjaIWANfH2G+u1IZ71cw7dpvW1FRUXnwjVGqUu3C/FYWpRTQLd9J2mYVp2sc6ODR1jh+vnhkaCB6cCSyOI36ciDPGGad5j9asNSucHqLg0WgkVSyUkxNlBtPgINBoIjsd/SN9XDxPiAue4JkXJoku1wP+C0XCIdGuDfMXpj0ZtlUU3FNd5GcbE9lBlggv3F5B7NfyfloPtD1p/esufaH9p0H1pmItCQ+OaIMolSbOeuLFnttPKEJKiVCgoCiX/Af4sla10/O6BsxLDxX38y0KVj0cX7e/3jJRxp1V9RcCAwEAAaMyMDAwHQYDVR0OBBYEFEX38BPzk+UmcA6SV5MxFCubg1rAMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBACuFs22c0aieLDzZUhcWB0xaLJdtSG9Ad4gh69F1m+3OhzTOSYrjY5xFVy/0pRfYAuMoxuPD74VdYDBa0epCfT1qFM5FfQ07OXtxzoNuuVTjjkB+Mzl6Als+9B+QptwvLw4JGJQPDuge6sShs18izP0wFzpKpFnC4GUTY47DiW3uOdYjQgYbMatcNGramkemH1oNRkrHy494GXKZp5I1JlwCgeY630ylli4j31KQgRZPge8QwAzzkLZDiS320GuVb2D6ElTvCLOTE8PungImR9VB3GfZvG6ATppnW855+og/emxPhwmoblcSbXLDzWykwyP0VVr0o2uY+qj7FuVER/XURMdfp36DMRJua4vPfvcBAvxCQvwKT79tcW3E0y0qkM47gcjZ1hVHOvDbIwWo849RZcq7hxHaQ0GHcUFILob3IjG5r34debZJm/uJ4wJ4oss6sD1FTDej8LfmkzYfxVxVAMUtRo+OyxOhWXGjIrcH3LOQoJkLs3hYrc62oQEn17FXvEgetwp4SaiQIPUALl5hyfAi1PkVvCbRb2rup5lc/ySh+1R0ax9LmW35h3M89ijXj18fcT6Hu8ToOVeS6JoyIZDs3PlU/acwwnwyOl4TYnc4nf4XJiRrByNCfN3/WlXLVr9oLB0sP32pStliqjSR7d9lWxxiSLfW1G1Qeiyn"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
2Mi3lKoJfj.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
2Mi3lKoJfj.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2Mi3lKoJfj.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab83e:$x4: Uninstalling... good bye :-( 0x2ad033:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
2Mi3lKoJfj.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadf0:$f1: FileZilla\recentservers.xml 0x2aae30:$f2: FileZilla\sitemanager.xml 0x2aae72:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0be:$b1: Chrome\User Data\ 0x2ab114:$b1: Chrome\User Data\ 0x2ab3ec:$b2: Mozilla\Firefox\Profiles 0x2ab4e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd46c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab640:$b4: Opera Software\Opera Stable\Login Data 0x2ab6fa:$b5: YandexBrowser\User Data\ 0x2ab768:$b5: YandexBrowser\User Data\ 0x2ab43c:$s4: logins.json 0x2ab172:$a1: username_value 0x2ab190:$a2: password_value 0x2ab47c:$a3: encryptedUsername 0x2fd3b0:$a3: encryptedUsername 0x2ab4a0:$a4: encryptedPassword 0x2fd3ce:$a4: encryptedPassword 0x2fd34c:$a5: httpRealm
2Mi3lKoJfj.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab928:$s3: Process already elevated. 0x28eb9c:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e925:$s5: GetKeyloggerLogsDirectory 0x28ebbf:$s6: set_PotentiallyVulnerablePasswords 0x2fea9a:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab83e:$x4: Uninstalling... good bye :-( 0x2ad033:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadf0:$f1: FileZilla\recentservers.xml 0x2aae30:$f2: FileZilla\sitemanager.xml 0x2aae72:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0be:$b1: Chrome\User Data\ 0x2ab114:$b1: Chrome\User Data\ 0x2ab3ec:$b2: Mozilla\Firefox\Profiles 0x2ab4e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd46c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab640:$b4: Opera Software\Opera Stable\Login Data 0x2ab6fa:$b5: YandexBrowser\User Data\ 0x2ab768:$b5: YandexBrowser\User Data\ 0x2ab43c:$s4: logins.json 0x2ab172:$a1: username_value 0x2ab190:$a2: password_value 0x2ab47c:$a3: encryptedUsername 0x2fd3b0:$a3: encryptedUsername 0x2ab4a0:$a4: encryptedPassword 0x2fd3ce:$a4: encryptedPassword 0x2fd34c:$a5: httpRealm
C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab928:$s3: Process already elevated. 0x28eb9c:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e925:$s5: GetKeyloggerLogsDirectory 0x28ebbf:$s6: set_PotentiallyVulnerablePasswords 0x2fea9a:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4099457933.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1669778784.000000001B950000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1640680973.0000000000772000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: 2Mi3lKoJfj.exe PID: 7300	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 7420	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.2Mi3lKoJfj.exe.770000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.2Mi3lKoJfj.exe.770000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.2Mi3lKoJfj.exe.770000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab83e:$x4: Uninstalling... good bye :-( 0x2ad033:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.2Mi3lKoJfj.exe.770000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadf0:$f1: FileZilla\recentservers.xml 0x2aae30:$f2: FileZilla\sitemanager.xml 0x2aae72:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0be:$b1: Chrome\User Data\ 0x2ab114:$b1: Chrome\User Data\ 0x2ab3ec:$b2: Mozilla\Firefox\Profiles 0x2ab4e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd46c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab640:$b4: Opera Software\Opera Stable\Login Data 0x2ab6fa:$b5: YandexBrowser\User Data\ 0x2ab768:$b5: YandexBrowser\User Data\ 0x2ab43c:$s4: logins.json 0x2ab172:$a1: username_value 0x2ab190:$a2: password_value 0x2ab47c:$a3: encryptedUsername 0x2fd3b0:$a3: encryptedUsername 0x2ab4a0:$a4: encryptedPassword 0x2fd3ce:$a4: encryptedPassword 0x2fd34c:$a5: httpRealm
0.0.2Mi3lKoJfj.exe.770000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab928:$s3: Process already elevated. 0x28eb9c:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e925:$s5: GetKeyloggerLogsDirectory 0x28ebbf:$s6: set_PotentiallyVulnerablePasswords 0x2fea9a:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\2Mi3lKoJfj.exe, ProcessId: 7300, TargetFilename: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe", CommandLine: "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, NewProcessName: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, OriginalFileName: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, ParentCommandLine: "C:\Users\user\Desktop\2Mi3lKoJfj.exe", ParentImage: C:\Users\user\Desktop\2Mi3lKoJfj.exe, ParentProcessId: 7300, ParentProcessName: 2Mi3lKoJfj.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe", ProcessId: 7420, ProcessName: RuntimeBroker.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe", ParentImage: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, ParentProcessId: 7420, ParentProcessName: RuntimeBroker.exe, ProcessCommandLine: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, ProcessId: 7472, ProcessName: schtasks.exe

Sigma detected: Suspicious Execution of Shutdown

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\shutdown.exe" /s /t 0, CommandLine: "C:\Windows\System32\shutdown.exe" /s /t 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\shutdown.exe, NewProcessName: C:\Windows\System32\shutdown.exe, OriginalFileName: C:\Windows\System32\shutdown.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe", ParentImage: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, ParentProcessId: 7420, ParentProcessName: RuntimeBroker.exe, ProcessCommandLine: "C:\Windows\System32\shutdown.exe" /s /t 0, ProcessId: 7672, ProcessName: shutdown.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\2Mi3lKoJfj.exe", ParentImage: C:\Users\user\Desktop\2Mi3lKoJfj.exe, ParentProcessId: 7300, ParentProcessName: 2Mi3lKoJfj.exe, ProcessCommandLine: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, ProcessId: 7328, ProcessName: schtasks.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\2Mi3lKoJfj.exe", ParentImage: C:\Users\user\Desktop\2Mi3lKoJfj.exe, ParentProcessId: 7300, ParentProcessName: 2Mi3lKoJfj.exe, ProcessCommandLine: "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f, ProcessId: 7328, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T07:42:02.002202+0100	2035595	1	Domain Observed Used for C2 Detected	194.26.192.167	2768	192.168.2.4	49730	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T07:42:02.002202+0100	2027619	1	Domain Observed Used for C2 Detected	194.26.192.167	2768	192.168.2.4	49730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2Mi3lKoJfj.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Avira: detection malicious, Label: HEUR/AGEN.1307453

Found malware configuration

Source: 2Mi3lKoJfj.exe

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "194.26.192.167:2768;", "SubDirectory": "RuntimeBroker", "InstallName": "RuntimeBroker.exe", "MutexName": "859d5f90-e2d0-4b2d-ba9f-5371df032ec2", "StartupKey": "RuntimeBroker", "LogDirectoryName": "Logs", "ServerSignature": "HLslqQCNhdORmt9FCkAoRZrPsL/QZ+X7L5BYCTwyjm+j0iRcqsXqSMBfjKaA0Z/VsXvYHImcNHtGPMZtFagEfGGsJYPbzXbkf3bmRGyrX2KjSu21OB4r/BrzkxWemrgblEj7tj3Y9suDtBtkRspLl3wICM1YJI4WF5dGSHgO3O28feawR8uCUuw8s95M470IepEqdwNbtYXzdtXfjNj6zQg8Eo0irBdcUB9eNuRVK8DeoMeer8ueo9HviqpSea31UwRMcLWq7EFFBLPAXSqpqg3G+qxE14o4wmdEHOwlFynUpEtiRkrdeIX89V+JIeue321yPIIt1PrQHqGp87c7BsOkaBTYZg7Pk104uKe/zWShInSWuvv0cc04ndks+SknWEjAJFoe6kGaTnEaa5bv8QiJ91McGOFEPJQhMyFnBlWiVeMEyro7LwGxg9QugfOmvOH3jNEb+EP4p+nNm/ywWgBWsSNTfrUyiBDGFNMqBG3Q5ObAvUHmJV/q5GxnJrgFN2wAL3CHP71RESbg8bTr8aMvv7wG5ih8ORKB8rrw41KPbosFIjjj1C/KKddXMW5E3K15+yZFqb7p/oeFiWJit3g0ETP7WskoSWzLqRAOV9A4tVX+LgEgv4pSmQE+x85dt80GcFPVHEUTTtYx+fCXD9Ux5n8b2GnSgBxQHYzhrLw=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANsXKsVBNY84Mxn9yL1q+zANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIyMjIxNDAwMloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApZBonJM7WYHmpm3qdrgPzvZzjN2KhDm7b6/Ed/STVeygNnLFcWZRg3SlTelP9JyCVSduUTu3rnUGjKv6Yy93iBREBOLUjz//kG9XFcu1bC7kspcUZsXwWvh4oTpK5TYTvNv+S33iVxkTFF1X2irKFrw1JqX+iTC8Gs7kzh6lD1oBzg8dCxiq1ztmOsvY4KF0/AeOr/1lVNT43QD+Mz0YgLOrAP88SIvZ6uSEKRpDJGHWMrDdvICjhDrH4G7sdT1lJyZfOqWKj3LjZfL9hKh1PZYRKlyoH764Y7J5LqqyyrBlr36kLdNoEYCHvywePknU5CS5024n73ozNQBIN1uf/gUjBOTbg6QMZLpN0TwI0TA+z2uEejwDvRZLi+nHdtsiIGfGjaIWANfH2G+u1IZ71cw7dpvW1FRUXnwjVGqUu3C/FYWpRTQLd9J2mYVp2sc6ODR1jh+vnhkaCB6cCSyOI36ciDPGGad5j9asNSucHqLg0WgkVSyUkxNlBtPgINBoIjsd/SN9XDxPiAue4JkXJoku1wP+C0XCIdGuDfMXpj0ZtlUU3FNd5GcbE9lBlggv3F5B7NfyfloPtD1p/esufaH9p0H1pmItCQ+OaIMolSbOeuLFnttPKEJKiVCgoCiX/Af4sla10/O6BsxLDxX38y0KVj0cX7e/3jJRxp1V9RcCAwEAAaMyMDAwHQYDVR0OBBYEFEX38BPzk+UmcA6SV5MxFCubg1rAMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBACuFs22c0aieLDzZUhcWB0xaLJdtSG9Ad4gh69F1m+3OhzTOSYrjY5xFVy/0pRfYAuMoxuPD74VdYDBa0epCfT1qFM5FfQ07OXtxzoNuuVTjjkB+Mzl6Als+9B+QptwvLw4JGJQPDuge6sShs18izP0wFzpKpFnC4GUTY47DiW3uOdYjQgYbMatcNGramkemH1oNRkrHy494GXKZp5I1JlwCgeY630ylli4j31KQgRZPge8QwAzzkLZDiS320GuVb2D6ElTvCLOTE8PungImR9VB3GfZvG6ATppnW855+og/emxPhwmoblcSbXLDzWykwyP0VVr0o2uY+qj7FuVER/XURMdfp36DMRJua4vPfvcBAvxCQvwKT79tcW3E0y0qkM47gcjZ1hVHOvDbIwWo849RZcq7hxHaQ0GHcUFILob3IjG5r34debZJm/uJ4wJ4oss6sD1FTDej8LfmkzYfxVxVAMUtRo+OyxOhWXGjIrcH3LOQoJkLs3hYrc62oQEn17FXvEgetwp4SaiQIPUALl5hyfAi1PkVvCbRb2rup5lc/ySh+1R0ax9LmW35h3M89ijXj18fcT6Hu8ToOVeS6JoyIZDs3PlU/acwwnwyOl4TYnc4nf4XJiRrByNCfN3/WlXLVr9oLB0sP32pStliqjSR7d9lWxxiSLfW1G1Qeiyn"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

ReversingLabs: Detection: 84%

Multi AV Scanner detection for submitted file

Source: 2Mi3lKoJfj.exe	Virustotal: Detection: 84%			Perma Link
Source: 2Mi3lKoJfj.exe	ReversingLabs: Detection: 84%

Yara detected Quasar RAT

Source: Yara match	File source: 2Mi3lKoJfj.exe, type: SAMPLE
Source: Yara match	File source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4099457933.00000000031DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1669778784.000000001B950000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1640680973.0000000000772000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2Mi3lKoJfj.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 2Mi3lKoJfj.exe

Joe Sandbox ML: detected

Source: 2Mi3lKoJfj.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: 2Mi3lKoJfj.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 194.26.192.167:2768 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 194.26.192.167:2768 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 194.26.192.167

Yara detected Generic Downloader

Source: Yara match	File source: 2Mi3lKoJfj.exe, type: SAMPLE
Source: Yara match	File source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 194.26.192.167:2768

Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90

Source: Joe Sandbox View

ASN Name: HEANETIE HEANETIE

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	TCP traffic detected without corresponding DNS query: 194.26.192.167
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ipwho.is

Source: RuntimeBroker.exe, 00000003.00000002.4106509469.000000001BA5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RuntimeBroker.exe, 00000003.00000002.4099105126.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RuntimeBroker.exe, 00000003.00000002.4099457933.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: RuntimeBroker.exe, 00000003.00000002.4099457933.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 2Mi3lKoJfj.exe, 00000000.00000002.1667910888.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000003.00000002.4099457933.0000000002DE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://api.ipify.org/
Source: RuntimeBroker.exe, 00000003.00000002.4099457933.0000000003175000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: 2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://ipwho.is/
Source: 2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: 2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: 2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 2Mi3lKoJfj.exe, type: SAMPLE
Source: Yara match	File source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4099457933.00000000031DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1669778784.000000001B950000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1640680973.0000000000772000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2Mi3lKoJfj.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 2Mi3lKoJfj.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 2Mi3lKoJfj.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 2Mi3lKoJfj.exe, type: SAMPLE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Process created: C:\Windows\System32\shutdown.exe "C:\Windows\System32\shutdown.exe" /s /t 0

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA57C16	3_2_00007FFD9BA57C16
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA63AF9	3_2_00007FFD9BA63AF9
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA5EB29	3_2_00007FFD9BA5EB29
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA49271	3_2_00007FFD9BA49271
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA5CAD5	3_2_00007FFD9BA5CAD5
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA58A0F	3_2_00007FFD9BA58A0F
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA4AFDD	3_2_00007FFD9BA4AFDD
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA5B851	3_2_00007FFD9BA5B851
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA49FD0	3_2_00007FFD9BA49FD0
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA68E30	3_2_00007FFD9BA68E30
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA455D6	3_2_00007FFD9BA455D6
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA4621F	3_2_00007FFD9BA4621F
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BB62326	3_2_00007FFD9BB62326

Source: 2Mi3lKoJfj.exe, 00000000.00000000.1640994131.0000000000A90000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename" vs 2Mi3lKoJfj.exe
Source: 2Mi3lKoJfj.exe, 00000000.00000002.1669778784.000000001B950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename" vs 2Mi3lKoJfj.exe
Source: 2Mi3lKoJfj.exe	Binary or memory string: OriginalFilename" vs 2Mi3lKoJfj.exe

Source: 2Mi3lKoJfj.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2Mi3lKoJfj.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 2Mi3lKoJfj.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 2Mi3lKoJfj.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@16/5@1/2

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe

File created: C:\Users\user\AppData\Roaming\RuntimeBroker

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7336:120:WilError_03
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\859d5f90-e2d0-4b2d-ba9f-5371df032ec2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03

Source: 2Mi3lKoJfj.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2Mi3lKoJfj.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2Mi3lKoJfj.exe	Virustotal: Detection: 84%
Source: 2Mi3lKoJfj.exe	ReversingLabs: Detection: 84%

Source: 2Mi3lKoJfj.exe

String found in binary or memory: HasSubValue3Conflicting item/add type

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe

File read: C:\Users\user\Desktop\2Mi3lKoJfj.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2Mi3lKoJfj.exe "C:\Users\user\Desktop\2Mi3lKoJfj.exe"
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process created: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\System32\shutdown.exe" /s /t 0
Source: C:\Windows\System32\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\System32\shutdown.exe" /s /t 0
Source: C:\Windows\System32\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process created: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\System32\shutdown.exe" /s /t 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\System32\shutdown.exe" /s /t 0	Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: shutdownext.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: shutdownext.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 2Mi3lKoJfj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2Mi3lKoJfj.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 2Mi3lKoJfj.exe

Static file information: File size 3266048 > 1048576

Source: 2Mi3lKoJfj.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c600

Source: 2Mi3lKoJfj.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Code function: 0_2_00007FFD9B7F00AD pushad ; iretd	0_2_00007FFD9B7F00C1
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9B6BEECF push ebx; ret	3_2_00007FFD9B6BEEDA
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9B6BEF45 push ebx; ret	3_2_00007FFD9B6BEF46
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9B6BD2A5 pushad ; iretd	3_2_00007FFD9B6BD2A6
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9B7D00AD pushad ; iretd	3_2_00007FFD9B7D00C1
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BA4336E push eax; ret	3_2_00007FFD9BA4340C
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 3_2_00007FFD9BB62326 push edx; retf 5F20h	3_2_00007FFD9BB65A3B
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Code function: 4_2_00007FFD9B7F00AD pushad ; iretd	4_2_00007FFD9B7F00C1

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe

File created: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	File opened: C:\Users\user\Desktop\2Mi3lKoJfj.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	File opened: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Memory allocated: 2B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Memory allocated: 1AD40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Memory allocated: 1ADB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Memory allocated: 3420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Memory allocated: 1B420000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Code function: 3_2_00007FFD9B7DF1F2 str ax

3_2_00007FFD9B7DF1F2

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Window / User API: threadDelayed 2852			Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Window / User API: threadDelayed 6889			Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe TID: 7536	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe TID: 7556	Thread sleep count: 2852 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe TID: 7556	Thread sleep count: 6889 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe TID: 7492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe TID: 7468	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RuntimeBroker.exe, 00000003.00000002.4107371523.000000001BB5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RuntimeBroker.exe, 00000003.00000002.4107576471.000000001BBA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: RuntimeBroker.exe, 00000003.00000002.4107371523.000000001BB5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWRSVP TCPv6 Service Provider
Source: RuntimeBroker.exe, 00000003.00000002.4107296276.000000001BB55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RuntimeBroker.exe, 00000003.00000002.4106204427.000000001BA00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@&

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Process created: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\System32\shutdown.exe" /s /t 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Process created: C:\Windows\System32\shutdown.exe "C:\Windows\System32\shutdown.exe" /s /t 0	Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe	Queries volume information: C:\Users\user\Desktop\2Mi3lKoJfj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Queries volume information: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	Queries volume information: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2Mi3lKoJfj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: 2Mi3lKoJfj.exe, type: SAMPLE
Source: Yara match	File source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4099457933.00000000031DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1669778784.000000001B950000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1640680973.0000000000772000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2Mi3lKoJfj.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: 2Mi3lKoJfj.exe, type: SAMPLE
Source: Yara match	File source: 0.0.2Mi3lKoJfj.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4099457933.00000000031DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1669778784.000000001B950000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1640680973.0000000000772000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2Mi3lKoJfj.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2Mi3lKoJfj.exe	85%	Virustotal		Browse
2Mi3lKoJfj.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
2Mi3lKoJfj.exe	100%	Avira	HEUR/AGEN.1307453
2Mi3lKoJfj.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1307453
C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar

Source	Detection	Scanner	Label	Link
194.26.192.167	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
ipwho.is	195.201.57.90	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
194.26.192.167	true	Avira URL Cloud: safe	unknown
https://ipwho.is/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org/	2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	false	high
https://stackoverflow.com/q/14436606/23354	2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	false	high
https://stackoverflow.com/q/2152978/23354sCannot	2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	false	high
http://schemas.datacontract.org/2004/07/	RuntimeBroker.exe, 00000003.00000002.4099457933.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2Mi3lKoJfj.exe, 00000000.00000002.1667910888.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000003.00000002.4099457933.0000000002DE9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ipwho.is	RuntimeBroker.exe, 00000003.00000002.4099457933.000000000318F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	2Mi3lKoJfj.exe, RuntimeBroker.exe.0.dr	false	high
https://ipwho.is	RuntimeBroker.exe, 00000003.00000002.4099457933.0000000003175000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.26.192.167	unknown	Netherlands		1213	HEANETIE	true
195.201.57.90	ipwho.is	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583601
Start date and time:	2025-01-03 07:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2Mi3lKoJfj.exe renamed because original name is a hash value
Original Sample Name:	b94af11cca65c557d23559e978a49d18.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@16/5@1/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 91% Number of executed functions: 61 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RuntimeBroker.exe, PID 7448 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:42:00	API Interceptor	14744148x Sleep call for process: RuntimeBroker.exe modified
06:41:59	Task Scheduler	Run new task: RuntimeBroker path: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
195.201.57.90	SPt4FUjZMt.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLine	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	WfKynArKjH.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, RedLine	Browse	/?output=json
	ubes6SC7Vd.exe	Get hash	malicious	Unknown	Browse	ipwhois.app/xml/
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json
	Clipper.exe	Get hash	malicious	Unknown	Browse	/?output=json
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipwho.is	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	108.181.61.49
	msgde.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	6ee7HCp9cD.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	wUSt04rfJ0.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	108.181.61.49
	StGx54oFh6.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	1AqzGcCKey.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	BJtvb5Vdhh.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	HquJT7q6xG.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
bg.microsoft.map.fastly.net	Reparto Trabajo TP4.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	DcRat, JasonRAT	Browse	199.232.214.172
	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.210.172
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.214.172
	Hornswoggle.exe	Get hash	malicious	GuLoader	Browse	199.232.214.172
	8n26gvrXUM.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HEANETIE	4.elf	Get hash	malicious	Unknown	Browse	87.44.44.181
	botx.x86.elf	Get hash	malicious	Mirai	Browse	136.206.122.80
	armv7l.elf	Get hash	malicious	Mirai	Browse	87.45.97.203
	armv6l.elf	Get hash	malicious	Mirai	Browse	143.239.172.125
	splspc.elf	Get hash	malicious	Unknown	Browse	136.206.67.80
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	87.44.85.54
	3.elf	Get hash	malicious	Unknown	Browse	87.47.150.191
	nshkppc.elf	Get hash	malicious	Mirai	Browse	87.46.25.34
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	87.42.38.252
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	87.45.27.239
HETZNER-ASDE	3.elf	Get hash	malicious	Unknown	Browse	195.201.78.91
	2.elf	Get hash	malicious	Unknown	Browse	212.127.42.203
	https://klickskydd.skolverket.org/?url=https%3A%2F%2Fwww.gazeta.ru%2Fpolitics%2Fnews%2F2024%2F12%2F22%2F24684722.shtml&id=71de&rcpt=upplysningstjansten@skolverket.se&tss=1735469857&msgid=b53e7603-c5d3-11ef-8a2e-0050569b0508&html=1&h=ded85c63	Get hash	malicious	HTMLPhisher	Browse	138.201.139.144
	https://www.gazeta.ru/politics/news/2024/12/22/24684722.shtml	Get hash	malicious	HTMLPhisher	Browse	138.201.139.144
	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	138.201.139.144
	http://www.rr8844.com	Get hash	malicious	Unknown	Browse	88.99.67.51
	DF2.exe	Get hash	malicious	Unknown	Browse	78.46.239.124
	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	116.203.13.109
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	116.203.13.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	195.201.57.90
	Sylacauga AL License.msg	Get hash	malicious	Unknown	Browse	195.201.57.90
	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	195.201.57.90
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	NOTIFICATION_OF_DEPENDANTS_1.vbs	Get hash	malicious	Xmrig	Browse	195.201.57.90
	CRf9KBk4ra.exe	Get hash	malicious	DCRat	Browse	195.201.57.90

Process:	C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2539954282295116
Encrypted:	false
SSDEEP:	6:kKrhF9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:j+DImsLNkPlE99SNxAhUe/3
MD5:	CCD166C069EF679B634972697403EA1E
SHA1:	DAF45DC15D33ED74B5E6793C8E5661AB974A506D
SHA-256:	4C176B0E3D64FF9518F23AF660E0403A9249E0B6520A8B51674A4D4860446A4C
SHA-512:	507E738345AF36D4C8CE73DB73BFFA26C61F97819818E23EA44D16B106E4760289E6C6C2A81B6EE99FD7631E6E44F2B6F406F08B5509B0F3561C005EC7315DE4
Malicious:	false
Preview:	p...... ..........6.]..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2Mi3lKoJfj.exe.log

Download File

Process:	C:\Users\user\Desktop\2Mi3lKoJfj.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\2Mi3lKoJfj.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3266048
Entropy (8bit):	6.084503895177852
Encrypted:	false
SSDEEP:	49152:PvSI22SsaNYfdPBldt698dBcjHNGRJ67bR3LoGdGH3THHB72eh2NT:Pv/22SsaNYfdPBldt6+dBcjHNGRJ6N
MD5:	B94AF11CCA65C557D23559E978A49D18
SHA1:	0C3436D0C5DF8E2E39BF4869BBE4413CA8D594B7
SHA-256:	F6A0A782D574DE811FE66ECF6416C69B486F9CA20FAF96CFC863A00063306338
SHA-512:	C1254360B2382957F043B8EDCF36B28F13A93D0860DC9609D9B46EDED81BC004E4149113E9EAAD8B4D2CC18164942588BD4E97ECD8FCE4F9AFD8E537BC668B16
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: ditekshen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@2...........@...................................1.W.....2.<.................... 2...................................................... ............... ..H............text...4.1.. ....1................. ..`.rsrc...<.....2.......1.............@..@.reloc....... 2.......1.............@..B..................1.....H........................k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.084503895177852
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	2Mi3lKoJfj.exe
File size:	3'266'048 bytes
MD5:	b94af11cca65c557d23559e978a49d18
SHA1:	0c3436d0c5df8e2e39bf4869bbe4413ca8d594b7
SHA256:	f6a0a782d574de811fe66ecf6416c69b486f9ca20faf96cfc863a00063306338
SHA512:	c1254360b2382957f043b8edcf36b28f13a93d0860dc9609d9b46eded81bc004e4149113e9eaad8b4d2cc18164942588bd4e97ecd8fce4f9afd8e537bc668b16
SSDEEP:	49152:PvSI22SsaNYfdPBldt698dBcjHNGRJ67bR3LoGdGH3THHB72eh2NT:Pv/22SsaNYfdPBldt6+dBcjHNGRJ6N
TLSH:	5BE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@2...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x71e42e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x640DFAE7 [Sun Mar 12 16:16:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31e3d4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x320000	0xa3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x322000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x31c434	0x31c600	959b3c04ca812044b9a1106a38e8ede0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x320000	0xa3c	0xc00	a5935f834a4ded3b46b17b880023c905	False	0.3505859375	data	5.260153502397429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x322000	0xc	0x200	99e75cdb3927a57ba5de39a6c2349231	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3200a0	0x2c4	data			0.4279661016949153
RT_MANIFEST	0x320364	0x6d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text			0.40319817247287265

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T07:42:02.002202+0100	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	194.26.192.167	2768	192.168.2.4	49730	TCP
2025-01-03T07:42:02.002202+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	194.26.192.167	2768	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 07:42:01.360343933 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:01.365250111 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:01.365340948 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:01.374972105 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:01.379717112 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:01.993784904 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:01.993802071 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:01.993875980 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:01.997425079 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:02.002202034 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:02.173552990 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:02.233514071 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:03.454555988 CET	49732	443	192.168.2.4	195.201.57.90
Jan 3, 2025 07:42:03.454596996 CET	443	49732	195.201.57.90	192.168.2.4
Jan 3, 2025 07:42:03.454678059 CET	49732	443	192.168.2.4	195.201.57.90
Jan 3, 2025 07:42:03.455657005 CET	49732	443	192.168.2.4	195.201.57.90
Jan 3, 2025 07:42:03.455676079 CET	443	49732	195.201.57.90	192.168.2.4
Jan 3, 2025 07:42:04.323565006 CET	443	49732	195.201.57.90	192.168.2.4
Jan 3, 2025 07:42:04.323759079 CET	49732	443	192.168.2.4	195.201.57.90
Jan 3, 2025 07:42:04.328438997 CET	49732	443	192.168.2.4	195.201.57.90
Jan 3, 2025 07:42:04.328449011 CET	443	49732	195.201.57.90	192.168.2.4
Jan 3, 2025 07:42:04.328680038 CET	443	49732	195.201.57.90	192.168.2.4
Jan 3, 2025 07:42:04.366624117 CET	49732	443	192.168.2.4	195.201.57.90
Jan 3, 2025 07:42:04.411325932 CET	443	49732	195.201.57.90	192.168.2.4
Jan 3, 2025 07:42:04.559921980 CET	443	49732	195.201.57.90	192.168.2.4
Jan 3, 2025 07:42:04.559977055 CET	443	49732	195.201.57.90	192.168.2.4
Jan 3, 2025 07:42:04.560023069 CET	49732	443	192.168.2.4	195.201.57.90
Jan 3, 2025 07:42:04.639028072 CET	49732	443	192.168.2.4	195.201.57.90
Jan 3, 2025 07:42:04.884108067 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:04.888969898 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:04.889045000 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:04.893872023 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:05.234359026 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:05.280458927 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:05.353907108 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:05.405442953 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:10.180813074 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:10.233443975 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:10.306983948 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:10.363185883 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:35.311443090 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:35.316497087 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:39.872502089 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:39.920840025 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:42:39.994837046 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:42:40.045775890 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:43:04.998775005 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:43:05.003595114 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:43:30.014288902 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:43:30.019186020 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:43:55.029795885 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:43:55.034739017 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:44:20.045306921 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:44:20.050219059 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:44:45.060851097 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:44:45.065885067 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:45:10.092000008 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:45:10.097110033 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:45:35.187570095 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:45:35.192470074 CET	2768	49730	194.26.192.167	192.168.2.4
Jan 3, 2025 07:46:00.201222897 CET	49730	2768	192.168.2.4	194.26.192.167
Jan 3, 2025 07:46:00.206129074 CET	2768	49730	194.26.192.167	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 07:42:03.443706036 CET	54142	53	192.168.2.4	1.1.1.1
Jan 3, 2025 07:42:03.451009035 CET	53	54142	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 07:42:03.443706036 CET	192.168.2.4	1.1.1.1	0x39f7	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 07:42:02.697722912 CET	1.1.1.1	192.168.2.4	0xd016	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 3, 2025 07:42:02.697722912 CET	1.1.1.1	192.168.2.4	0xd016	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 3, 2025 07:42:03.451009035 CET	1.1.1.1	192.168.2.4	0x39f7	No error (0)	ipwho.is	195.201.57.90	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipwho.is

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	195.201.57.90	443	7420	C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 06:42:04 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2025-01-03 06:42:04 UTC	223	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 06:42:04 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2025-01-03 06:42:04 UTC	1021	IN	Data Raw: 33 66 31 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f Data Ascii: 3f1{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.189", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yo

Target ID:	0
Start time:	01:41:56
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\2Mi3lKoJfj.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\2Mi3lKoJfj.exe"
Imagebase:	0x770000
File size:	3'266'048 bytes
MD5 hash:	B94AF11CCA65C557D23559E978A49D18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1669778784.000000001B950000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1640680973.0000000000772000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:41:57
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:41:57
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:41:58
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"
Imagebase:	0x6d0000
File size:	3'266'048 bytes
MD5 hash:	B94AF11CCA65C557D23559E978A49D18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.4099457933.00000000031DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe, Author: ditekshen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	01:41:59
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
Imagebase:	0xd40000
File size:	3'266'048 bytes
MD5 hash:	B94AF11CCA65C557D23559E978A49D18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:41:59
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:41:59
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:42:09
Start date:	03/01/2025
Path:	C:\Windows\System32\shutdown.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\shutdown.exe" /s /t 0
Imagebase:	0x7ff7a2bf0000
File size:	28'160 bytes
MD5 hash:	F2A4E18DA72BB2C5B21076A5DE382A20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:42:09
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:42:38
Start date:	03/01/2025
Path:	C:\Windows\System32\shutdown.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\shutdown.exe" /s /t 0
Imagebase:	0x7ff7a2bf0000
File size:	28'160 bytes
MD5 hash:	F2A4E18DA72BB2C5B21076A5DE382A20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:42:38
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B7F3525 Relevance: 1.6, APIs: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B7F3607

Memory Dump Source

Source File: 00000000.00000002.1670908832.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_2Mi3lKoJfj.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3b284fc15df134492a03276780d4271fd3fbd9ece4cb13c15461ba245708ab33
Instruction ID: 0cb1905b8c6b3cecef55421ce666ec286eb3fc94548c4d51d5687683c68ad2c4
Opcode Fuzzy Hash: 3b284fc15df134492a03276780d4271fd3fbd9ece4cb13c15461ba245708ab33
Instruction Fuzzy Hash: 0131163190CB4C4FDB19DB6888596E97FF0EF56311F0542AFC049D75A2CB34A905C791

Function 00007FFD9B7F3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B7F3607

Memory Dump Source

Source File: 00000000.00000002.1670908832.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_2Mi3lKoJfj.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c234a9c6199dadb6daeb88f67ed5f4833d16f504419bcbd8037e9a47d404aa95
Instruction ID: e9aeedc9e0e12aff582aa6dcc78d1d29fc2ece21304b3b34b0cad1cfcfd4c983
Opcode Fuzzy Hash: c234a9c6199dadb6daeb88f67ed5f4833d16f504419bcbd8037e9a47d404aa95
Instruction Fuzzy Hash: 9631E63190DB5C8FDB19DB6888596E9BBF0FF65311F05426FD049D31A2CB74A805CB91

Function 00007FFD9B7F206A Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B7F3607

Memory Dump Source

Source File: 00000000.00000002.1670908832.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7f0000_2Mi3lKoJfj.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: da0d63134d3efa36210d877cfbe87f6829214188104dc340cb03ed6d08f79f3b
Instruction ID: 429ca4d238eff1ad113bf1c22315462b327db8a14b1e2a9ed321458470b98afb
Opcode Fuzzy Hash: da0d63134d3efa36210d877cfbe87f6829214188104dc340cb03ed6d08f79f3b
Instruction Fuzzy Hash: 8631C531A08A1C9FDB58DF98C449AFDBBE0FF55311F00822FD04AD3651DB74A9458B91

Analysis Process: RuntimeBroker.exePID: 7420, Parent PID: 7300COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BB62326 Relevance: 7.4, Strings: 1, Instructions: 6106COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9BB65619

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: c740864a3aa3be24c8a3dd016ad3643357d4acb7e9ca8468525c57c3a2a1f881
Instruction ID: a3e56bfd5a651b8fb0b9f9f4bb0283ee63dffb1457e4b9e2ce7218f8021cc629
Opcode Fuzzy Hash: c740864a3aa3be24c8a3dd016ad3643357d4acb7e9ca8468525c57c3a2a1f881
Instruction Fuzzy Hash: 3573B312B1AE4F4FF7B596AC047527962C2FFD86A4B9A417AD01EC32F6ED19ED024340

Function 00007FFD9BA5CAD5 Relevance: 3.7, Strings: 2, Instructions: 1223COMMON

Download Yara Rule

Strings

W&_L, xrefs: 00007FFD9BA5CD6F
V1_H, xrefs: 00007FFD9BA5CDD2

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: V1_H$W&_L
API String ID: 0-2225251907
Opcode ID: 3c3e878a749f932a7d2d3f52fa4d03761ae887ee2f175f3325d6f87e497fcae0
Instruction ID: a100fd79e8d9a11edf4924283f757c0b0a2c126761248bf02db6389e93d61b72
Opcode Fuzzy Hash: 3c3e878a749f932a7d2d3f52fa4d03761ae887ee2f175f3325d6f87e497fcae0
Instruction Fuzzy Hash: 60825B31B1EA4E4FE7B4DBE88465AB837D1EF95310B0601B9D08DC71A7EE9C6E068741

Function 00007FFD9BA5B851 Relevance: 2.2, Strings: 1, Instructions: 926
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d&_H, xrefs: 00007FFD9BA5C074

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: d&_H
API String ID: 0-3974368547
Opcode ID: a90bd5f9a27fb626c825074e611d8ed8b34266856b5def0cfcb3e41a1bfb94c6
Instruction ID: 1ae5d7cc176070d29c7a75313a71f821adb99fce7300861e0561766f11a0c919
Opcode Fuzzy Hash: a90bd5f9a27fb626c825074e611d8ed8b34266856b5def0cfcb3e41a1bfb94c6
Instruction Fuzzy Hash: F552F231B19E4D4FDBA8EF9884656B9B3D1FF98301F41067DD44EC32A6DEA4B9428780

Function 00007FFD9BA455D6 Relevance: 2.1, Instructions: 2125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c50a486ce9114a8eb8956640749ad1f618d6adc239cdc8149d3a050a06930c
Instruction ID: 7ecbbb586ee2a3bf046fcadef5171dd4cd6d328611d2e48824245598c909a435
Opcode Fuzzy Hash: f1c50a486ce9114a8eb8956640749ad1f618d6adc239cdc8149d3a050a06930c
Instruction Fuzzy Hash: A2F29F70A19A0D8FDFA8DF58C894BA977E2FF98300F1141A9D44ED72A6DE74E941CB40

Function 00007FFD9BA49FD0 Relevance: 1.1, Instructions: 1062
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb2ceb2357dee5993e731d6de154c68854d1235b8b7bbc49185b48e46d53d5c
Instruction ID: 6786b05a74f043e7f41a07ee2631cfaad9829bf90601b7acfeb1af75e47440c3
Opcode Fuzzy Hash: beb2ceb2357dee5993e731d6de154c68854d1235b8b7bbc49185b48e46d53d5c
Instruction Fuzzy Hash: 7462393171D94D4FEBA8EB6CD4A5A7933D2EF99300B0601B9E44EC72E6DE64EC428741

Function 00007FFD9BA5EB29 Relevance: 1.0, Instructions: 969
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a0c9d6834f92c3cf948e7ab89e284bdae02c54ac9e5dd8e2efbd66da1bf9b5
Instruction ID: b01bda5498e31c93af9da9be84f8e869caac09b13854a8995ad10447cdee65d8
Opcode Fuzzy Hash: 01a0c9d6834f92c3cf948e7ab89e284bdae02c54ac9e5dd8e2efbd66da1bf9b5
Instruction Fuzzy Hash: 1862C231B18A4E4FDB98DF5888A16A973E2FF98300F1501A9E45AC72D6CE75ED428741

Function 00007FFD9BA4AFDD Relevance: .9, Instructions: 862COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24846447f3f4a6e48b0592ccf4ecbc175a995d7c6b6ca908e4a8151c4e8876a
Instruction ID: 9240bda7edb34126bf898879d8f6b2493409540027dff58d3a6fb7924b75d826
Opcode Fuzzy Hash: d24846447f3f4a6e48b0592ccf4ecbc175a995d7c6b6ca908e4a8151c4e8876a
Instruction Fuzzy Hash: 63527330B08A498FEB98EB2CC4A4B7577E2FF99300F5545B9E44DC72A6CE74E8418B41

Function 00007FFD9BA49271 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6d3ec082fbae77bdce0ad5d2f4e88452fc372fe94ea149f1638e210a7fc094
Instruction ID: 4954d3416a6785480cd2f7b603a993ed9c56fec2acd3fa23967348caf8ae1570
Opcode Fuzzy Hash: 3e6d3ec082fbae77bdce0ad5d2f4e88452fc372fe94ea149f1638e210a7fc094
Instruction Fuzzy Hash: 2322AF30B09A0D4FEBA8DB6D84A97B973E2FF99300F51417DD44EC32A2CE74A9468741

Function 00007FFD9BA68E30 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee9972bc158f4d3c96eacb921eb5310b90185f32c15b6a92593f1b4730e34c9
Instruction ID: 076b671412d0f3d67eb36cd56cc876c96bac3ba26e811876260c9c8f9f547019
Opcode Fuzzy Hash: 8ee9972bc158f4d3c96eacb921eb5310b90185f32c15b6a92593f1b4730e34c9
Instruction Fuzzy Hash: 7C025E70B1894D8FDB98EF68C4A5EA977E2FFA8340F114179E40DC3296DE64EC418780

Function 00007FFD9BA63AF9 Relevance: .5, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2721345fec1a13e155f3548c3a6f62fdb4c3407b7fefb05ee4607f5fcc433d64
Instruction ID: b04617d148186e427406b16168c404d4d907e58b7a72c310731d589278ca128c
Opcode Fuzzy Hash: 2721345fec1a13e155f3548c3a6f62fdb4c3407b7fefb05ee4607f5fcc433d64
Instruction Fuzzy Hash: 67F12670B1DA4D8FEBA4EB6C84A567437D2FF98300B0505B9D04DC72E2DE69AD478341

Function 00007FFD9BA4621F Relevance: .5, Instructions: 533COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86f0608e0970c2fbd308927b64ba1b49456949b694bbee90cbc3be43fd3ccec
Instruction ID: 0ad773de999aad0962976d0cd12900a719b22a384743ceef9f4391d8f17bbd80
Opcode Fuzzy Hash: c86f0608e0970c2fbd308927b64ba1b49456949b694bbee90cbc3be43fd3ccec
Instruction Fuzzy Hash: 35025C30E18A1D8FEBA8DF58C4947B9B3E2FF98301F1545B9D44ED32A5DA74B9818B40

Function 00007FFD9BA57C16 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79fddab94b971f017fb1bcaa090395ce26f8705a0ddaaddd5cbae2dc74dea31
Instruction ID: 78d0f1fa8ff42cf999dbea866b0cc5d4ec2f18f937cac53cbeece4b049a8bc26
Opcode Fuzzy Hash: d79fddab94b971f017fb1bcaa090395ce26f8705a0ddaaddd5cbae2dc74dea31
Instruction Fuzzy Hash: EEF1C530609A8D8FEBA8DF68C855BF977D1FF54310F04426EE84DC7295CB749A458B82

Function 00007FFD9BA58A0F Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7851c738cf6f8ac834255052fc4d6773d14fca6c6fba077166ea14ca13b8c0d4
Instruction ID: f38de633dbbd9e99d73b0728300e68bbcc52f6918d57919681696f1b93965f3a
Opcode Fuzzy Hash: 7851c738cf6f8ac834255052fc4d6773d14fca6c6fba077166ea14ca13b8c0d4
Instruction Fuzzy Hash: EFE1B230A09A4D8FEBA8DF68C8657ED77D1FB54310F01422ED84DC7295DFB8AA408B81

Function 00007FFD9BA4E6F9 Relevance: 1.8, APIs: 1, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4111572734.00007FFD9BA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba40000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfaaaa91d665a83478144032e89661bc1118105cb09814fa1caba7d28e2bd66a
Instruction ID: b4e5f2477f0c01ac7c803f140ab366a874bc937ac0562895abba286a7cee145f
Opcode Fuzzy Hash: cfaaaa91d665a83478144032e89661bc1118105cb09814fa1caba7d28e2bd66a
Instruction Fuzzy Hash: EE714631B1DA4D4FDB68EB6C98665F9B7E1EF99310B0442BFD049C7297DE24A8028781

Function 00007FFD9B7D3525 Relevance: 1.6, APIs: 1, Instructions: 132
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9B7D3607

Memory Dump Source

Source File: 00000003.00000002.4109333215.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b7d0000_RuntimeBroker.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 5462767fc94b4015a4d1651b12ee893937da22625433bb942eb66ce498b24b8a
Instruction ID: 2bd7f9b24b614ac6a9018da5b9cd306ce71b993349f198519c1eb312645ce632
Opcode Fuzzy Hash: 5462767fc94b4015a4d1651b12ee893937da22625433bb942eb66ce498b24b8a
Instruction Fuzzy Hash: AF41163190DB4C8FDB59DF6888596E97BF0FF96311F0542ABD049C71A2DA24A809C791

Function 00007FFD9B7D3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9B7D3607

Memory Dump Source

Source File: 00000003.00000002.4109333215.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b7d0000_RuntimeBroker.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1d3f35bcb4f1c16bac66cb6f9841f2fa20088f62f9a08502dac3c0b80d900177
Instruction ID: 7cfc8fb1434b9cd790aeb3f3b1c706afa0c1b00c50b3afaf7c294445ca98e7c2
Opcode Fuzzy Hash: 1d3f35bcb4f1c16bac66cb6f9841f2fa20088f62f9a08502dac3c0b80d900177
Instruction Fuzzy Hash: 3431E43190DB5C8FDB19DB588859AE9BBF0FFA6311F05426FD049D32A2CB74A805CB91

Function 00007FFD9BB652F1 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9BB652F1

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: ae87104d11d8d9150e5954212d92aa8ceb35f654d66beb3651123fbeaa7062c1
Instruction ID: d9a2403cfbd4960ffb7b65756376a970bd98cb1edde4f1b9042c2763146095ef
Opcode Fuzzy Hash: ae87104d11d8d9150e5954212d92aa8ceb35f654d66beb3651123fbeaa7062c1
Instruction Fuzzy Hash: CD21FB02B1EA4E4FF7B5A66C047927866C2EFD8564B5A01BAD41EC72F6ED19ED014300

Function 00007FFD9BB6207D Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e5d9038dedbebf48f1756f20751da6c44caa7596ce38b4e895eac213acafea
Instruction ID: 2e57c5c567a92ab45df7460fd65e03218c11e8cfe89983c391286470b038edaa
Opcode Fuzzy Hash: 62e5d9038dedbebf48f1756f20751da6c44caa7596ce38b4e895eac213acafea
Instruction Fuzzy Hash: 7181AF11B1AFAA5FE7A597AC88A577972D6EF98700F460179D10CC32E3CE5CAE064381

Function 00007FFD9BB60001 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8758863122a74c92947193aed2a93efe3ebff85822ceada03b253fe1b8056a2
Instruction ID: b45162fb495c1d3c982a92d011e892e1c0f07a22a405e6bce3785a9ac6b01f8e
Opcode Fuzzy Hash: a8758863122a74c92947193aed2a93efe3ebff85822ceada03b253fe1b8056a2
Instruction Fuzzy Hash: 4441E462A0EACD4FD76696684879BB13FE1EF66620B4A02FFD08DC71E3D905AD418341

Function 00007FFD9B6BED65 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4109071859.00007FFD9B6BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b6bd000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b7ec306b41aba7746d4ffc68d69bfe7b27705eb8a769d5ce9fed7243bd98d9
Instruction ID: bed7eb6b3235ae02ec0935f88201a97ed2268a9f6c2670f94ca9785107feab77
Opcode Fuzzy Hash: 93b7ec306b41aba7746d4ffc68d69bfe7b27705eb8a769d5ce9fed7243bd98d9
Instruction Fuzzy Hash: E841087150EBC44FD7A68B2898558513FF0EF56320B1506DFD0D8CF1A3C664B846CB92

Function 00007FFD9BB6014A Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fb75af149fffd0c9a82d1d6cd018d9310cc5112f131f1d8fbfa687e763b34d
Instruction ID: af701eed28c746f98f50391fa52c6a212298f18b88835789068fe6f53286b60c
Opcode Fuzzy Hash: a3fb75af149fffd0c9a82d1d6cd018d9310cc5112f131f1d8fbfa687e763b34d
Instruction Fuzzy Hash: 1D314722B1EA8D4FE798DB6D44B66B477C1FF65720B4501BDE48EC32E2DD08AC428342

Function 00007FFD9BB60676 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4327fbad28dc79eb5865793d23f1bc2eccf7da44bd0e42bbe80966f419acb1
Instruction ID: 5bacaaf7061f80501f15631b20cedfe817d90e263ad570c9d64e4131ca2d7f2b
Opcode Fuzzy Hash: 2b4327fbad28dc79eb5865793d23f1bc2eccf7da44bd0e42bbe80966f419acb1
Instruction Fuzzy Hash: C2314862B1DA8D4FE7989A5C58767B477C1FBA4724F85017DD48EC32E7DC18AC018342

Function 00007FFD9BB62AAF Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3f15bb833e88cd4b8a5d41d1c0c80fee88135c716a828acac3f4e9f7bcdd27
Instruction ID: b55b718965e7ec79d0bdbb673827bb5fd5f74b37a68f6099c08b126a6155fc86
Opcode Fuzzy Hash: af3f15bb833e88cd4b8a5d41d1c0c80fee88135c716a828acac3f4e9f7bcdd27
Instruction Fuzzy Hash: 6121BB12B1AE4F4FF7B996AC146527C62C3EFD86A475A02BAD00EC72FAED15DD424340

Function 00007FFD9BB635BA Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20ccceef5634b10f045bb4d2f8c475626ff39d28bdb0070bb29bb6035100d24
Instruction ID: 9bfafe191ce51c257d2ac8ca18efa903b59122326552527476a3a922a506e53a
Opcode Fuzzy Hash: f20ccceef5634b10f045bb4d2f8c475626ff39d28bdb0070bb29bb6035100d24
Instruction Fuzzy Hash: FB21D712B1EE4F0FE7B9966C146567862C2EFD42A479A017AD00EC33E6ED19ED424341

Function 00007FFD9BB63D9F Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b58132004598916bc233b67b2d57ba0f7ef74a447f6f0373ec7e24356cf70db
Instruction ID: 5183b397b0e65689843ccea1cee17846eab22996f039650b293a44aca203dcdb
Opcode Fuzzy Hash: 9b58132004598916bc233b67b2d57ba0f7ef74a447f6f0373ec7e24356cf70db
Instruction Fuzzy Hash: 7421C312B1EE4F4FF7B6966C087567866C2EFD826475A41BAD00EC32E7ED19ED024340

Function 00007FFD9BB63293 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18faa8e6d3f38c1a89486569908b59df8b648ca55474a279e25041a89105d9ef
Instruction ID: 4af1bd67e92d5ab29e136b747f0d8fbe0be0a1299d175be7b23c5edbe335588c
Opcode Fuzzy Hash: 18faa8e6d3f38c1a89486569908b59df8b648ca55474a279e25041a89105d9ef
Instruction Fuzzy Hash: 0B21B612B1AE4F4FF7B5A6AC047567872C2EFD86A4B5A417AD00EC32F6ED19ED424340

Function 00007FFD9BB65090 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9e7f35421260eae3f70c80b8131004b013eecdeea7af25ecd5434a23a1d69d
Instruction ID: 981f293ba77bfe6a54ee2831a34bd14e70e729683cab68537eed236c7eff5429
Opcode Fuzzy Hash: 0b9e7f35421260eae3f70c80b8131004b013eecdeea7af25ecd5434a23a1d69d
Instruction Fuzzy Hash: 3B21B412B1AE4F4FE7B5966C047567862C2FFD8264B9A41BAD00EC72E6ED19ED024380

Function 00007FFD9BB643EE Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8845b08d1635ee69f9ad5104a1dccb0c6ee4b94aa525f531876edc45a461c464
Instruction ID: da3264e5e1cb8a73c44eb077ff8d853bad5e53ae97418aa8588ba96e47a05295
Opcode Fuzzy Hash: 8845b08d1635ee69f9ad5104a1dccb0c6ee4b94aa525f531876edc45a461c464
Instruction Fuzzy Hash: 5F21F812B1EE4F0FF7B9A66C047517461C2EFD866479A027ED00EC32E6ED19ED024340

Function 00007FFD9BB639C2 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b402e8d54debed3bb33f12f96d1af435934bbaf6cb866178ae09644d92a53044
Instruction ID: 5d4f601ac76f8bbd7a44d18cb58a97f3bc6f71aa9cab9e3f9f10363b1357b37c
Opcode Fuzzy Hash: b402e8d54debed3bb33f12f96d1af435934bbaf6cb866178ae09644d92a53044
Instruction Fuzzy Hash: 51218812B1AE4E4FE7B5A66C146527876C2EFD856475A02BBD00EC33EAED25ED424340

Function 00007FFD9BB6292E Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07cbc2df43bf42777c20f0286aa4049073664f2d3c310b0db91105a605e2f7f
Instruction ID: 9f797a032975798a078c60844abb34e060fee068f6e4155754c5eebe9f67563d
Opcode Fuzzy Hash: b07cbc2df43bf42777c20f0286aa4049073664f2d3c310b0db91105a605e2f7f
Instruction Fuzzy Hash: 6721CB11B1AE4F4FF7B5A66C046567861C2EFD866479A42BAD40EC33F7ED19ED024340

Function 00007FFD9BB6555F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec65cf9c34cea8a73dfd375ea5c9994f9d3dfc974426601a2bfe69dbb48b9183
Instruction ID: e6682e3a9bb2cd0b0cc2d1980f5bc215a294a7c4f1577e1cf2edfd06635412d0
Opcode Fuzzy Hash: ec65cf9c34cea8a73dfd375ea5c9994f9d3dfc974426601a2bfe69dbb48b9183
Instruction Fuzzy Hash: 4221CB12B1AE4E4FF7B5966C047967861C3FFD826479A02BAD40EC73E6ED19ED024340

Function 00007FFD9BB63762 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08efab67f14344d7f57a3a590887c77507ce1123b37e25621b05777956ce85de
Instruction ID: 4f6b4188feafbfe1dd0016d68b29349f7cc912fc88859425b7bdf4420e73b1a8
Opcode Fuzzy Hash: 08efab67f14344d7f57a3a590887c77507ce1123b37e25621b05777956ce85de
Instruction Fuzzy Hash: 8821F811B1AE4E4FF7B9A66C146567971C3EFD826479A02BAD40EC33E6ED29ED024300

Function 00007FFD9BB64E48 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc618f0e25938716751b78adf792bf21a8010f7e22281e0a1a7d801a223905a5
Instruction ID: cc0c5dc95c6f39cdece030da7f2f3a4d9c529f1270207a1c669a8c84bf555ebd
Opcode Fuzzy Hash: cc618f0e25938716751b78adf792bf21a8010f7e22281e0a1a7d801a223905a5
Instruction Fuzzy Hash: C621F811B1AE4F4FE7B9A66C04B527861C2EFD816475A42BDD01EC33F6ED29ED024340

Function 00007FFD9BB63CF1 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83515d40bad65b90e10509b99e8ccfa65531aeb8cd98babab23e60fc50b8bf74
Instruction ID: aa07a4e9087ee0f623645b2bca65431ed23580e05914627dbf6f4f3c6be750fb
Opcode Fuzzy Hash: 83515d40bad65b90e10509b99e8ccfa65531aeb8cd98babab23e60fc50b8bf74
Instruction Fuzzy Hash: 3E210A12B1EE4F4FF7B5A66C0465278B1C2EFD826479A42BAD01EC32E6DD29DD424340

Function 00007FFD9BB626DA Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e9a0bffa841868df78015066ff1a6920f8ff6fb3192c3b7b197b9d24d82c82
Instruction ID: 362d28214ea9e87d6a9bf21e424107a52bd0a628e29e6f58715edd2396b84b6f
Opcode Fuzzy Hash: 42e9a0bffa841868df78015066ff1a6920f8ff6fb3192c3b7b197b9d24d82c82
Instruction Fuzzy Hash: 1921D712B1AE4E0FF3B996AC147567961C3EFD8264B9A41BAD40EC33F6DC19ED464340

Function 00007FFD9BB63B82 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515d7cf157f129959b0da72a0a07fd23b19e0e63f7814f7641ab84a42d049102
Instruction ID: 62f1c60c2bbd3dbc5e5c0151af4d6473bf24b189371df737f37afac48407b38e
Opcode Fuzzy Hash: 515d7cf157f129959b0da72a0a07fd23b19e0e63f7814f7641ab84a42d049102
Instruction Fuzzy Hash: 0B11E622B1EE4F4FF7B5966C0474278A6C2EFC922475E01BAD44EC32E6ED2ADC024300

Function 00007FFD9BB6597E Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e66d835acb512ce4d87c15cd28dc180975034c35ccea8d8072ba936c4a26668
Instruction ID: d9b11e654533260a95a7b1b06d469ac3f3fa4da45c631c4dcd83b774d7367ec3
Opcode Fuzzy Hash: 6e66d835acb512ce4d87c15cd28dc180975034c35ccea8d8072ba936c4a26668
Instruction Fuzzy Hash: 4611B61271AE4E4FF7B9A66C1465678A2C2EFC422475A02BAD41EC73E6ED29ED424300

Function 00007FFD9BB65330 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53e8af7924bd2055ab71fa37b7a6253707befe7aaef05e9e205d9a4440930b1
Instruction ID: becc8377f6cf0208b0270805c7e7aba46eff6d89cb17d9eece6b9f71cda7013c
Opcode Fuzzy Hash: e53e8af7924bd2055ab71fa37b7a6253707befe7aaef05e9e205d9a4440930b1
Instruction Fuzzy Hash: FF11C81271AE4E4FF7B5966C1474678A2C2EFC8664B5A02BAD41EC73E6ED29ED024340

Function 00007FFD9BB65268 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246bb5f6a098962a3c6b6c2ffc70af4e1bd73288f484e3c7c1ca23b7056ee322
Instruction ID: e71532717cfa325c8838c3d164687da58ffd322c663524bedcc74536a601053e
Opcode Fuzzy Hash: 246bb5f6a098962a3c6b6c2ffc70af4e1bd73288f484e3c7c1ca23b7056ee322
Instruction Fuzzy Hash: 9B11EB1271AE4F4FF7F5966C1474678B1C2EFD826475A01B9D44EC72E6ED19DD018300

Function 00007FFD9BB62342 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57aba3687788e29547b749cc289f9abd97508715ca9a8587515fc105830e84ef
Instruction ID: c83f4e3fc2ffa16b16659018b7e2d6986cead851c11be187401807b1cc39c34c
Opcode Fuzzy Hash: 57aba3687788e29547b749cc289f9abd97508715ca9a8587515fc105830e84ef
Instruction Fuzzy Hash: E611B123A0FBCA4FE76387B858A01607FA1AF9712474E01FBD098CB1F7D919AD068311

Function 00007FFD9BB60EE1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4112333614.00007FFD9BB60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7132ee8eef00a2a47b9499304da65b0b0587b90a3f8772fa7fd1dea43b6e66bc
Instruction ID: c277094a63c695ef2070010399b23b5bf5c8e96c6e2dfb846ddffadd09b4ac22
Opcode Fuzzy Hash: 7132ee8eef00a2a47b9499304da65b0b0587b90a3f8772fa7fd1dea43b6e66bc
Instruction Fuzzy Hash: 75D0C711B1A5154BF21411CC68623F8B185DBC8754F511237D409C62E6C8CE6DC542C2

Non-executed Functions

Function 00007FFD9B7DF1F2 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4109333215.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b7d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4298868b97980445e5d5c272daf9e2cfb6694a7b22e7685cbcfb5ae1d9f0cac8
Instruction ID: 3e5e262c76ada3a934f261909915bcfe50caa2483cc820e77c58e5ed09571075
Opcode Fuzzy Hash: 4298868b97980445e5d5c272daf9e2cfb6694a7b22e7685cbcfb5ae1d9f0cac8
Instruction Fuzzy Hash: CA31521FF091E216D715F3BCB5B68ED3B60DF8227E71982F3D19D4D0A79C04208A4295

Analysis Process: RuntimeBroker.exePID: 7448, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B7F0B78 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

;M_I, xrefs: 00007FFD9B7F0C04

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: ;M_I
API String ID: 0-1276053120
Opcode ID: f6cc38a9e5b8432612579d4edf6022de715f31de580790dec61726522bd4ba9f
Instruction ID: b59b2e6b992af11cdd90efd6ee4613f70f92dad391b28adc8028b8584692d022
Opcode Fuzzy Hash: f6cc38a9e5b8432612579d4edf6022de715f31de580790dec61726522bd4ba9f
Instruction Fuzzy Hash: E6A16D25B0F6C94BE3249B6C68745A87FE1FF91704B9542FAE488473FBD928A801C385

Function 00007FFD9B7F15FA Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

.M_^, xrefs: 00007FFD9B7F1601

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: .M_^
API String ID: 0-2820351210
Opcode ID: 747a9978078ed1ccac7da01fe2f52fb743bbbd62d9bff7fe183f6c7e5ed22da0
Instruction ID: 51d5e58b6e6bdf569144e0e611c36c9901932db9e3842cca4da8460930d28796
Opcode Fuzzy Hash: 747a9978078ed1ccac7da01fe2f52fb743bbbd62d9bff7fe183f6c7e5ed22da0
Instruction Fuzzy Hash: 0121F316B0EA9D0FD365AB6C9C751F47BE0EF96221B0E03F7C089C71A3DC0859064394

Function 00007FFD9B7F2188 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0898392373bc9f4e67657cd2d4c62d718052f06358e1a5abac5462a017e75e
Instruction ID: 852b0771116f41139ac4caff365c094a5b5b5a126515ffe193206a1ee34f457d
Opcode Fuzzy Hash: 2b0898392373bc9f4e67657cd2d4c62d718052f06358e1a5abac5462a017e75e
Instruction Fuzzy Hash: 2491D731B19E4E4FEBA5EB6884657B977D2EF94340F4502B5E40DC72F6DD28AD028384

Function 00007FFD9B7F2DE9 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbb51378bc6f6c2439ce93a787378f68897c05e67a30859f93e70c635eb830a
Instruction ID: 26b65636d940d049fea7ba6f761283d344dde8eaf20f2f1ba635703a5dd921ab
Opcode Fuzzy Hash: 3bbb51378bc6f6c2439ce93a787378f68897c05e67a30859f93e70c635eb830a
Instruction Fuzzy Hash: 9C619861B1990D4FDB98EBA884757FCB7D2EF98310F554279E05ED32E6CE146C428780

Function 00007FFD9B7F2729 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb08ab80d2e4b3ddc1424fc24ec99ee12c08e6c59e51040b984c3f6b3efdd650
Instruction ID: 25e576ec286d16fd034b52a5ede85083fb5ce4a3c7ff578371ddd78864ade4c3
Opcode Fuzzy Hash: cb08ab80d2e4b3ddc1424fc24ec99ee12c08e6c59e51040b984c3f6b3efdd650
Instruction Fuzzy Hash: F4415F21B1DB490FE75897AC94657B97BD1EF94314F40027EF05EC32E2CD286D028796

Function 00007FFD9B7F24E8 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1634cbe9db76019001b989e22ba739e7b2b69ce1c415e24a2bc02eafe9200d6
Instruction ID: 502b4002d40c0bc4b823c136b4c17dcc7e92b697def8230310fcf5ca8573f9d6
Opcode Fuzzy Hash: d1634cbe9db76019001b989e22ba739e7b2b69ce1c415e24a2bc02eafe9200d6
Instruction Fuzzy Hash: C0418628B19D1E0FEA94F6685075AFD6AD3FB94280B9145B4E01DD36EACD2CDD128384

Function 00007FFD9B7F196D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9203ffc76b708750fc55d526d1737f16222c6e3ba512f8ec1065c4b5c9aa6f
Instruction ID: 1f014d5dbb9f7ffc1aed9ab29263348cb992171c3d9331e84f82cf3ed4282a8c
Opcode Fuzzy Hash: 3a9203ffc76b708750fc55d526d1737f16222c6e3ba512f8ec1065c4b5c9aa6f
Instruction Fuzzy Hash: C3210331B0E6864FDB55DB6880D55A57B91EF51310F1683FAC0588B5BBD928AC86C3C0

Function 00007FFD9B7F1BF5 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e335cad53a13f00281d11b93003801d363ca8ad1683eb926aa3c173dc2e2672f
Instruction ID: c454446dbe73dc916c316c787d0ac18b76907c5003c05beb7bd475e43f8ab23f
Opcode Fuzzy Hash: e335cad53a13f00281d11b93003801d363ca8ad1683eb926aa3c173dc2e2672f
Instruction Fuzzy Hash: 4531B4386099894FE358E71CB0A9AE97FB1BBD4308FC045E5E418A33DACA3CA415C751

Function 00007FFD9B7F32DD Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de179a8debc0b43d30450df6ffab21b8c6e31cfbc3609e80b70790ca1631ba3c
Instruction ID: 2fc2d9db848a8cd12dab870a45ae1dea4751e9169f75d452905c4003e918b7f1
Opcode Fuzzy Hash: de179a8debc0b43d30450df6ffab21b8c6e31cfbc3609e80b70790ca1631ba3c
Instruction Fuzzy Hash: BE21F431F19A5D4FD794EB6898699A877D1FF58305B4601B6E40DC72A6DE28EC00C781

Function 00007FFD9B7F0872 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78952f713ca394bfd7df78c62711959cd1c4ee7c320480face10f6c97eedb9f
Instruction ID: 8835550423c541dac0ba3bea576b9a6857f6700b304cd96f5c49c310ffa0d169
Opcode Fuzzy Hash: b78952f713ca394bfd7df78c62711959cd1c4ee7c320480face10f6c97eedb9f
Instruction Fuzzy Hash: C221E792B1EBC64FE355AB644835AA57FA1EF51740F4506FAD099C72E7EC1828048391

Function 00007FFD9B7F3491 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b51c72c8ae40254496845ac2b24cabf67b029a8f57b4a019449c540a60a059cd
Instruction ID: 7749674ce60c721377dc53477067dcc175d920c7ee7382345ab4a2c6dd7f0839
Opcode Fuzzy Hash: b51c72c8ae40254496845ac2b24cabf67b029a8f57b4a019449c540a60a059cd
Instruction Fuzzy Hash: CB117D21B0EB850FE395E6786C698F57FD0DF9022470503BBE44CC31B3CD0895868391

Function 00007FFD9B7F28D5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396a8372869d3e6d24a05ee1bee0cc4a3461b30504077316cf957504feedd9ce
Instruction ID: 2781bcd954107f2cb66156e1b87b5396acbd94ebed4a636039cb44bfe43b42de
Opcode Fuzzy Hash: 396a8372869d3e6d24a05ee1bee0cc4a3461b30504077316cf957504feedd9ce
Instruction Fuzzy Hash: 5B11C620B0EBCD0FE347E37858A8AA43FD1EF46215B0A41E7E488CB0B7C9584945C342

Function 00007FFD9B7F0DA9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c167362b41d3dc5a957dd829cf78b58e5c3395d2033a59e68262e0f8e2d12e
Instruction ID: 24796269d54d89061df1a1df490b55fd6b77a638835a8a731d82387323ecd581
Opcode Fuzzy Hash: 46c167362b41d3dc5a957dd829cf78b58e5c3395d2033a59e68262e0f8e2d12e
Instruction Fuzzy Hash: 73014E5371AD8E0ADBA5A62C54A59F67B82DBD5710B0506B6D40DC23B6DD18BD4243C0

Function 00007FFD9B7F1E58 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438500eb9df471dce427ea4611a325c169b5f8130cddda9fa0823cb93a827a76
Instruction ID: b6ee8f7ec8c951da5c002d9f40693b11a758fce38e8021a804c49389cc8aa791
Opcode Fuzzy Hash: 438500eb9df471dce427ea4611a325c169b5f8130cddda9fa0823cb93a827a76
Instruction Fuzzy Hash: D2F0F022F1981D0FE754F6AD54ECAFA7BD1DBAC22671502B7E40CC72B7DC0498428381

Function 00007FFD9B7F1E70 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33c4f289f0f918d9ca77e1d5369cc6352d16bd8c698e3263572bb0c8931fbce
Instruction ID: 460693d778915d3dc3532e3c8fef514c5ede74a2b54f19813b0bd8c65b91c4a7
Opcode Fuzzy Hash: a33c4f289f0f918d9ca77e1d5369cc6352d16bd8c698e3263572bb0c8931fbce
Instruction Fuzzy Hash: C1E09B21F19C1D1FA794F6AD44DDF7966C1DBAC2117510576E41CC72B6DC149C418381

Function 00007FFD9B7F094D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264275a600972998d3d8d45f3add922ad5f20d2365c9327ef6caecc6211609c7
Instruction ID: dceda6915c54ad741f89ddeebac1050784350ac23a6cb71f09d814d11a86b593
Opcode Fuzzy Hash: 264275a600972998d3d8d45f3add922ad5f20d2365c9327ef6caecc6211609c7
Instruction Fuzzy Hash: E7E02622F1A91A57E394337820364FC2581CF48690B41053AE40DC62EBEC1D6D420284

Function 00007FFD9B7F2DC8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1700131975.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb34cfd6402c0cf2cd3d1552bc79771280b33ffe8363ad7088facd0752a6bcfc
Instruction ID: 4f5a2ac70440ddbf5dd8d05bae4b54741cff1a685b8801eb762a0e07459db911
Opcode Fuzzy Hash: eb34cfd6402c0cf2cd3d1552bc79771280b33ffe8363ad7088facd0752a6bcfc
Instruction Fuzzy Hash: 99C01262B16E4E4BDB65EFC824912F87691FFC83807D50239A008E2175CF241551A284

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2Mi3lKoJfj.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2Mi3lKoJfj.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

C:\Users\user\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
2Mi3lKoJfj.exe

Function 00007FFD9B7F3525 Relevance: 1.6, APIs: 1, Instructions: 116
fileCOMMON

Function 00007FFD9B7F3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Function 00007FFD9B7F206A Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre