RuntimeBroker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RuntimeBroker.exe
Size 7.3MB
Sample260508-phrxmact2r
SHA256 b9f71ed4b08c93a7fc5468bee23660e3129e1cf9c84100d4d40ad70fb7c851fa
MD5 def4f909eeed327ab949d99a810ff64e
SHA1 3668e6ca6e282334535c796a3a8817c6a23b6a50
SHA512 c56efc554d1aa59345da04e1c82c0a2b825d0b9392a33f956bc2074439c65f8dec85556df406f745edb3107b0fd5e8ba65497846627865dbe61c211102d2006c
SSDEEP 98304:0i3Qm0vuJyIvFbWMVqqLKYhebCtjlKSObn+:7CpQvK17
TLSH
T118765B53F66290ECC16DC1B4831A6632FB32B88A073476EB57D086213E66FD06B3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RuntimeBroker.exe

File Explorer

RuntimeBroker.exe

.exe 7.3MB

RuntimeBroker.exe

IMPHASH c6968d4f1c415fa3e43f6c6377cd6b0b
SHA256 b9f71ed4b08c93a7fc5468bee23660e3129e1cf9c84100d4d40ad70fb7c851fa
MD5 def4f909eeed327ab949d99a810ff64e
SHA1 3668e6ca6e282334535c796a3a8817c6a23b6a50
SHA512 c56efc554d1aa59345da04e1c82c0a2b825d0b9392a33f956bc2074439c65f8dec85556df406f745edb3107b0fd5e8ba65497846627865dbe61c211102d2006c
SSDEEP 98304:0i3Qm0vuJyIvFbWMVqqLKYhebCtjlKSObn+:7CpQvK17
TLSH
T118765B53F66290ECC16DC1B4831A6632FB32B88A073476EB57D086213E66FD06B3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5895120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RuntimeBroker.pdb

kernel32

FindClose HeapFree PostQueuedCompletionStatus GetProcessHeap LoadLibraryExA GetProcAddress FindNextFileW SetThreadPriority SleepConditionVariableSRW GetQueuedCompletionStatusEx WakeConditionVariable InitializeConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetExitCodeProcess DuplicateHandle SetWaitableTimer CreateIoCompletionPort SetFileCompletionNotificationModes GetFinalPathNameByHandleW CreateWaitableTimerExW GetModuleHandleA SleepEx SetHandleInformation GetModuleHandleW FormatMessageW LoadLibraryA WriteConsoleW CreateDirectoryW GetFullPathNameW CreateFileW SetFileInformationByHandle GetFileInformationByHandle HeapAlloc GetModuleFileNameW GetTempPathW GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex WriteFileEx ReadFileEx GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW CreateMutexA DeleteProcThreadAttributeList CreateProcessW GetCurrentProcess UpdateProcThreadAttribute InitializeProcThreadAttributeList GetSystemInfo WaitForSingleObjectEx RtlLookupFunctionEntry CreatePseudoConsole CreatePipe GetCurrentThreadId TerminateProcess ClosePseudoConsole Sleep GetCurrentThread SetThreadStackGuarantee IsProcessorFeaturePresent CreateThread IsDebuggerPresent SetLastError GetSystemTimeAsFileTime WaitForSingleObject GetCurrentProcessId CloseHandle SetErrorMode GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx SwitchToThread HeapReAlloc GetLastError FindFirstFileExW GetComputerNameExW InitializeSListHead SetUnhandledExceptionFilter GetCommandLineW AddVectoredExceptionHandler RtlCaptureContext RtlVirtualUnwind FreeEnvironmentStringsW GetEnvironmentStringsW UnhandledExceptionFilter CompareStringOrdinal QueryPerformanceFrequency GetEnvironmentVariableW MultiByteToWideChar WideCharToMultiByte lstrlenW GetCurrentDirectoryW QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

GetKeyState EnumDisplayMonitors SetWindowsHookExW PeekMessageW TranslateMessage GetMonitorInfoW GetWindowTextW SendInput DispatchMessageW GetForegroundWindow CallNextHookEx GetCursorPos UnhookWindowsHookEx

ntdll

RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtWriteFile NtReadFile NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile

oleaut32

SysStringLen GetErrorInfo SysFreeString

ole32

CoTaskMemFree CoInitializeEx

mfplat

MFCreateAttributes MFStartup MFShutdown

mf

MFEnumDeviceSources

mfreadwrite

MFCreateSourceReaderFromMediaSource

d3d11

D3D11CreateDevice

crypt32

CertVerifyCertificateChainPolicy CertFreeCertificateChain CertOpenStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertCloseStore CertFreeCertificateContext CertGetCertificateChain CertDuplicateStore CertAddCertificateContextToStore CertEnumCertificatesInStore

bcryptprimitives

ProcessPrng

advapi32

GetUserNameW SystemFunction036

ws2_32

bind WSASocketW WSACleanup getaddrinfo connect freeaddrinfo getsockname getpeername getsockopt WSAStartup closesocket setsockopt send recv WSAIoctl recvfrom socket ioctlsocket sendto WSAGetLastError

secur32

DeleteSecurityContext EncryptMessage FreeContextBuffer DecryptMessage AcceptSecurityContext FreeCredentialsHandle InitializeSecurityContextW AcquireCredentialsHandleA QueryContextAttributesW

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses

vcruntime140

memcmp memcpy memset memmove longjmp __C_specific_handler __intrinsic_setjmp __current_exception __current_exception_context __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-math-l1-1-0

log10 round logf floorf log sqrt __setusermatherr exp ceil pow

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

__p__commode __acrt_iob_func __stdio_common_vfprintf fopen fclose __stdio_common_vsprintf _set_fmode

api-ms-win-crt-runtime-l1-1-0

_initterm_e _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm terminate _register_thread_local_exe_atexit_callback _c_exit _crt_atexit _register_onexit_function _initialize_onexit_table abort _beginthreadex exit _exit _cexit __p___argv __p___argc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale