Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-11-2024 18:03
General
-
Target
RuntimeBroker.exe
-
Size
48KB
-
MD5
2cf2fb01a8362489f63554136ca9f1fa
-
SHA1
408c57e91927664c2075606c8a4687b42704340e
-
SHA256
2ae77e1af8c3932f0ab68d03c5dafb8a743eb25243a1b6a55a488c3884d8517b
-
SHA512
5ae02306c4107712543b7bb3a061f3ddee93b19121efead18f6b73eff375329bbaffa4f8366dce8df202237824b24fca8e7bf7b0fa5d8fa5b4bff163dcfb404a
-
SSDEEP
768:+ujYs1TUET1/WUT1V9mo2qzzyYA8STpFWPIwZ2kn0bhTGFD5bvjToTc/442UBDZB:+ujYs1TU0r2IAfu2zbhTG/bQTK2idHh
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
hand-incorrect.gl.at.ply.gg:7439
Mutex
wGBckV1hzh4H
Attributes
-
delay
3
-
install
true
-
install_file
RuntimeBroker.exe
-
install_folder
%Temp%
aes.plain
Signatures
-
Asyncrat family
-
Drops file in Windows directory 4 IoCs
Processes:
UserOOBEBroker.exedescription ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RuntimeBroker.exeFileCoAuth.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RuntimeBroker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 2088 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
RuntimeBroker.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 4812 RuntimeBroker.exe Token: SeDebugPrivilege 4812 RuntimeBroker.exe Token: SeDebugPrivilege 2088 taskmgr.exe Token: SeSystemProfilePrivilege 2088 taskmgr.exe Token: SeCreateGlobalPrivilege 2088 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe 2088 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:768
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:2896
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:3544
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2088