Analysis
- user interaction
yes - max time kernel
20s - max time network
21s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
23/05/2026, 04:13
General
- Target Runtime Broker.exe
- Size 3.0MB
- Sample260523-etc8haft5x
- SHA256 21a68dda823bccf5c0eb9a6d40708c8300e3e69b16e085192de18699142be770
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system32\Runtime Broker.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\system32\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\system32\Runtime Broker.exe"2⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system32\Runtime Broker.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Runtime Broker.exe.log
Runtime Broker.exe
memory/2780-11-0x0000013401F50000-0x0000013401F8A000-memory.dmp
memory/2780-12-0x0000013465280000-0x00000134652D0000-memory.dmp
memory/2780-21-0x0000013401F20000-0x0000013401F21000-memory.dmp
memory/2780-19-0x00000134020F0000-0x000001340213A000-memory.dmp
memory/2780-20-0x0000013402140000-0x000001340216A000-memory.dmp
memory/2780-8-0x0000013465270000-0x0000013465280000-memory.dmp
memory/2780-9-0x0000013401F20000-0x0000013401F21000-memory.dmp
memory/2780-10-0x0000013401F40000-0x0000013401F52000-memory.dmp
memory/2780-18-0x00000134020A0000-0x00000134020EC000-memory.dmp
memory/2780-17-0x0000013402060000-0x0000013402094000-memory.dmp
memory/2780-13-0x000001347F450000-0x000001347F502000-memory.dmp
memory/2780-14-0x0000013401F90000-0x0000013401FDA000-memory.dmp
memory/2780-15-0x0000013401FE0000-0x000001340202E000-memory.dmp
memory/2780-16-0x0000013402030000-0x0000013402056000-memory.dmp
memory/4496-3-0x000001471B2D0000-0x000001471B2D1000-memory.dmp
memory/4496-0-0x0000014700B20000-0x0000014700E30000-memory.dmp
memory/4496-1-0x000001471B560000-0x000001471B570000-memory.dmp
memory/4496-2-0x00000147011F0000-0x000001470120E000-memory.dmp
memory/4496-4-0x000001471B2D0000-0x000001471B2D1000-memory.dmp