File name:

RuntimeBroker2.exe

Full analysis: https://app.any.run/tasks/cdac5ede-8550-4f7b-a41e-2ea67559661b
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 22:51:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
quasar
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

BF99AB92032C4DE479E7015F60604389

SHA1:

846F8F4266E2F3200F8203D8C58B52514081A277

SHA256:

BDBCA7F0EAF017356859B1DF339EBB738B59CF0F1AF0FFB6E1D6A65277C2C4E0

SSDEEP:

3072:TtdHLuN/Mn5B5tKPeNWPLhKvbOM9MGNCvVcdSgJpfoNZjn3PMSNSbk/sO9bclZNm:Jdds9ajoNZj3VSbMj9b2CylOkk88

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • QUASAR mutex has been found

      • RuntimeBroker2.exe (PID: 3756)
      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker.exe (PID: 6652)
      • RuntimeBroker2.exe (PID: 3836)
      • RuntimeBroker2.exe (PID: 2388)
      • RuntimeBroker2.exe (PID: 7096)
      • RuntimeBroker.exe (PID: 6304)
      • RuntimeBroker2.exe (PID: 7004)

    • Changes the autorun value in the registry

      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker.exe (PID: 6652)

    • QUASAR has been detected (YARA)

      • RuntimeBroker.exe (PID: 6652)

  • SUSPICIOUS

    • Checks for external IP

      • svchost.exe (PID: 2200)
      • RuntimeBroker2.exe (PID: 3756)
      • RuntimeBroker.exe (PID: 6652)
      • RuntimeBroker2.exe (PID: 1712)

    • Executable content was dropped or overwritten

      • RuntimeBroker2.exe (PID: 1712)

    • There is functionality for taking screenshot (YARA)

      • RuntimeBroker.exe (PID: 6652)

    • Starts itself from another location

      • RuntimeBroker2.exe (PID: 1712)

  • INFO

    • Checks supported languages

      • RuntimeBroker2.exe (PID: 3756)
      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker.exe (PID: 6652)
      • RuntimeBroker2.exe (PID: 2388)
      • RuntimeBroker.exe (PID: 6304)
      • RuntimeBroker2.exe (PID: 7096)
      • RuntimeBroker2.exe (PID: 3836)
      • RuntimeBroker2.exe (PID: 7004)

    • Disables trace logs

      • RuntimeBroker2.exe (PID: 3756)
      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker.exe (PID: 6652)

    • Reads the computer name

      • RuntimeBroker2.exe (PID: 3756)
      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker.exe (PID: 6652)
      • RuntimeBroker2.exe (PID: 3836)
      • RuntimeBroker2.exe (PID: 2388)
      • RuntimeBroker2.exe (PID: 7096)
      • RuntimeBroker.exe (PID: 6304)
      • RuntimeBroker2.exe (PID: 7004)

    • Reads the machine GUID from the registry

      • RuntimeBroker2.exe (PID: 3756)
      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker2.exe (PID: 3836)
      • RuntimeBroker2.exe (PID: 2388)
      • RuntimeBroker2.exe (PID: 7096)
      • RuntimeBroker.exe (PID: 6304)
      • RuntimeBroker2.exe (PID: 7004)
      • RuntimeBroker.exe (PID: 6652)

    • Checks proxy server information

      • RuntimeBroker2.exe (PID: 3756)
      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker.exe (PID: 6652)
      • slui.exe (PID: 2144)

    • Reads the software policy settings

      • RuntimeBroker2.exe (PID: 3756)
      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker.exe (PID: 6652)
      • slui.exe (PID: 2144)

    • Manual execution by a user

      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker2.exe (PID: 2388)
      • RuntimeBroker2.exe (PID: 3836)
      • RuntimeBroker.exe (PID: 6304)
      • RuntimeBroker2.exe (PID: 7004)
      • RuntimeBroker2.exe (PID: 7096)

    • Creates files in the program directory

      • RuntimeBroker2.exe (PID: 1712)

    • Launching a file from a Registry key

      • RuntimeBroker2.exe (PID: 1712)
      • RuntimeBroker.exe (PID: 6652)

    • Creates files or folders in the user directory

      • RuntimeBroker.exe (PID: 6652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:08 10:40:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 270848
InitializedDataSize: 3072
UninitializedDataSize: -
EntryPoint: 0x4407e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.0.0
ProductVersionNumber: 1.2.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.2.0.0
InternalName: Client.exe
LegalCopyright:
OriginalFileName: Client.exe
ProductVersion: 1.2.0.0
AssemblyVersion: 1.2.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
10
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #QUASAR runtimebroker2.exe svchost.exe #QUASAR runtimebroker2.exe #QUASAR runtimebroker.exe #QUASAR runtimebroker2.exe no specs #QUASAR runtimebroker2.exe no specs slui.exe #QUASAR runtimebroker2.exe no specs #QUASAR runtimebroker.exe no specs #QUASAR runtimebroker2.exe

Process information

PID
CMD
Path
Indicators
Parent process
1712"C:\Users\admin\Desktop\RuntimeBroker2.exe" C:\Users\admin\Desktop\RuntimeBroker2.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\runtimebroker2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2144C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2388"C:\Users\admin\Desktop\RuntimeBroker2.exe"C:\Users\admin\Desktop\RuntimeBroker2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\runtimebroker2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
3756"C:\Users\admin\Desktop\RuntimeBroker2.exe" C:\Users\admin\Desktop\RuntimeBroker2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\runtimebroker2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3836"C:\Users\admin\Desktop\RuntimeBroker2.exe" C:\Users\admin\Desktop\RuntimeBroker2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\runtimebroker2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6304"C:\Program Files (x86)\WindowsGUISubsystem\RuntimeBroker.exe"C:\Program Files (x86)\WindowsGUISubsystem\RuntimeBroker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\program files (x86)\windowsguisubsystem\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6652"C:\Program Files (x86)\WindowsGUISubsystem\RuntimeBroker.exe"C:\Program Files (x86)\WindowsGUISubsystem\RuntimeBroker.exe
RuntimeBroker2.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
1.2.0.0
Modules
Images
c:\program files (x86)\windowsguisubsystem\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7004"C:\Users\admin\Desktop\RuntimeBroker2.exe" C:\Users\admin\Desktop\RuntimeBroker2.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\runtimebroker2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7096"C:\Users\admin\Desktop\RuntimeBroker2.exe" C:\Users\admin\Desktop\RuntimeBroker2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\runtimebroker2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
4 881
Read events
4 851
Write events
30
Delete events
0

Modification events

(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3756) RuntimeBroker2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RuntimeBroker2_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6652RuntimeBroker.exeC:\Users\admin\AppData\Roaming\WindowsGUISubsystem\06-21-2025binary
MD5:C93F235DE888193DAA3CC811517CE4F0
SHA256:C879577249195A14B124D50E1E5F43C87A8BE5D28903E6D2C347A387E6604016
1712RuntimeBroker2.exeC:\Program Files (x86)\WindowsGUISubsystem\RuntimeBroker.exeexecutable
MD5:BF99AB92032C4DE479E7015F60604389
SHA256:BDBCA7F0EAF017356859B1DF339EBB738B59CF0F1AF0FFB6E1D6A65277C2C4E0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
51
DNS requests
24
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3756
RuntimeBroker2.exe
GET
301
88.198.193.213:80
http://telize.com/geoip
unknown
—
—
malicious
1712
RuntimeBroker2.exe
GET
301
88.198.193.213:80
http://telize.com/geoip
unknown
—
—
malicious
1712
RuntimeBroker2.exe
GET
200
3.33.130.190:80
http://freegeoip.net/xml/
unknown
—
—
shared
1712
RuntimeBroker2.exe
GET
200
172.67.74.152:80
http://api.ipify.org/
unknown
—
—
malicious
6652
RuntimeBroker.exe
GET
301
88.198.193.213:80
http://telize.com/geoip
unknown
—
—
malicious
6652
RuntimeBroker.exe
GET
200
3.33.130.190:80
http://freegeoip.net/xml/
unknown
—
—
shared
6652
RuntimeBroker.exe
GET
200
172.67.74.152:80
http://api.ipify.org/
unknown
—
—
malicious
4944
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6652
RuntimeBroker.exe
GET
301
88.198.193.213:80
http://telize.com/geoip
unknown
—
—
malicious
6652
RuntimeBroker.exe
GET
200
3.33.130.190:80
http://freegeoip.net/xml/
unknown
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4648
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3756
RuntimeBroker2.exe
88.198.193.213:80
telize.com
Hetzner Online GmbH
DE
malicious
3756
RuntimeBroker2.exe
88.198.193.213:443
telize.com
Hetzner Online GmbH
DE
malicious
3756
RuntimeBroker2.exe
3.33.130.190:80
freegeoip.net
AMAZON-02
US
shared
3756
RuntimeBroker2.exe
172.67.74.152:80
api.ipify.org
CLOUDFLARENET
US
shared
4
System
192.168.100.255:138
—
—
—
whitelisted
1712
RuntimeBroker2.exe
88.198.193.213:80
telize.com
Hetzner Online GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
telize.com
  • 88.198.193.213
malicious
www.telize.com
  • 88.198.193.213
malicious
freegeoip.net
  • 3.33.130.190
  • 15.197.148.33
shared
api.ipify.org
  • 172.67.74.152
  • 104.26.13.205
  • 104.26.12.205
shared
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.0
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.2
  • 20.190.159.71
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.75
  • 40.126.31.1
  • 40.126.31.128
  • 40.126.31.73
  • 20.190.159.0
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.55.104.190
  • 23.55.104.172
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (freegeiop .net in DNS lookup)
2200
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
3756
RuntimeBroker2.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup api.ipify.org
3756
RuntimeBroker2.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
1712
RuntimeBroker2.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup api.ipify.org
1712
RuntimeBroker2.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
1712
RuntimeBroker2.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup api.ipify.org
1712
RuntimeBroker2.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
6652
RuntimeBroker.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
6652
RuntimeBroker.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RuntimeBroker2.exe