RuntimeHost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RuntimeHost.exe
Size 2.5MB
Sample260708-msd3eaet9z
SHA256 3a4d07872d64ab6531a4975132976d66e87e62adf8be89d4012311fd8a3b30d9
MD5 e106c3e79471f2e6117f967672730e29
SHA1 5abc95a545e5ca89f72b66e51c34e40b1141db48
SHA512 9a5f0d33d207d2647e3a5b63ba7f0c8794e95a87193729f42c2070e675cd5df0731e34220b53e98cd08644fef41efff70f5d755aac3150d0d40da7f11b9879d4
SSDEEP 49152:Uwjkvh1xjfQd6JsMrwVFbrUeaeK06noA4SIGhZyu6PlYyf+BR48c:Zaho6JsMrwVFbrUeaXe/tYyf+BR48c
TLSH
T15FC5C006B39643ADC1A7A4388B93D327E773B4480721D2DF73D84A68AB577E01A7B741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RuntimeHost.exe

File Explorer

RuntimeHost.exe

.exe 2.5MB

RuntimeHost.exe

IMPHASH ea78e648e7b1e62df8afcb8d5ec1bc86
SHA256 3a4d07872d64ab6531a4975132976d66e87e62adf8be89d4012311fd8a3b30d9
MD5 e106c3e79471f2e6117f967672730e29
SHA1 5abc95a545e5ca89f72b66e51c34e40b1141db48
SHA512 9a5f0d33d207d2647e3a5b63ba7f0c8794e95a87193729f42c2070e675cd5df0731e34220b53e98cd08644fef41efff70f5d755aac3150d0d40da7f11b9879d4
SSDEEP 49152:Uwjkvh1xjfQd6JsMrwVFbrUeaeK06noA4SIGhZyu6PlYyf+BR48c:Zaho6JsMrwVFbrUeaXe/tYyf+BR48c
TLSH
T15FC5C006B39643ADC1A7A4388B93D327E773B4480721D2DF73D84A68AB577E01A7B741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

931920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

bcrypt

BCryptGenRandom

shell32

ShellExecuteW

crypt32

CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext

ws2_32

gethostname ntohs WSASetLastError sendto recvfrom bind connect select getpeername getsockname htons recv setsockopt listen htonl socket accept __WSAFDIsSet WSAGetLastError closesocket WSAEventSelect WSAEnumNetworkEvents WSACreateEvent ioctlsocket WSACloseEvent send getsockopt getaddrinfo inet_ntop inet_pton freeaddrinfo WSAIoctl

kernel32

SleepConditionVariableSRW SetLastError DeviceIoControl Sleep GetLastError SizeofResource GetModuleFileNameW CreateFileW LockResource CloseHandle LoadResource FindResourceW GetModuleHandleW GetTempPathW GetCommandLineW GetCurrentProcess GetFileAttributesExW GetProcAddress IsDebuggerPresent CheckRemoteDebuggerPresent LoadLibraryW GetLocalTime WakeAllConditionVariable CreateToolhelp32Snapshot Process32FirstW lstrcmpiW SetPriorityClass SetThreadPriority GetCurrentThread MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter SetUnhandledExceptionFilter DeleteCriticalSection GetCurrentProcessId GetCurrentThreadId GetSystemDirectoryW FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree SleepEx VirtualAlloc VirtualFree GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx GetFileAttributesW GetFileInformationByHandleEx CreateFile2 GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW FindFirstFileW FindClose CreateDirectoryW InitializeCriticalSectionEx GetLocaleInfoEx FormatMessageA Process32NextW

user32

TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowRect IsWindowVisible GetClassNameA GetWindowTextA FindWindowA GetWindowLongW DispatchMessageA SetWindowPos ScreenToClient SetLayeredWindowAttributes LoadCursorW SetWindowLongW GetClientRect PeekMessageA GetCursorPos SetWindowDisplayAffinity GetAsyncKeyState GetWindowThreadProcessId IsWindow EnumWindows MessageBoxW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow TranslateMessage PostQuitMessage UpdateWindow GetMessageExtraInfo GetKeyState GetCapture ClientToScreen

advapi32

ControlService CreateServiceW CloseServiceHandle GetTokenInformation OpenProcessToken CryptAcquireContextW CryptReleaseContext DeleteService StartServiceW OpenServiceW CryptEncrypt CryptGetHashParam CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash OpenSCManagerW

msvcp140

??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Random_device@std@@YAIXZ _Query_perf_frequency _Query_perf_counter _Thrd_hardware_concurrency _Mtx_lock _Thrd_id _Thrd_join _Mtx_unlock _Thrd_yield ?_Xbad_function_call@std@@YAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

ntdll

NtQuerySystemInformation RtlAdjustPrivilege

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception wcschr strrchr memset memmove memcpy memcmp _CxxThrowException strchr strstr __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy memchr

api-ms-win-crt-runtime-l1-1-0

_get_wide_winmain_command_line __sys_errlist __sys_nerr _register_thread_local_exe_atexit_callback _c_exit _errno abort _beginthreadex _exit _initterm_e _initterm _initialize_wide_environment system _configure_wide_argv _set_app_type _seh_filter_exe terminate _cexit _crt_atexit _register_onexit_function _initialize_onexit_table exit _invoke_watson

api-ms-win-crt-stdio-l1-1-0

fflush ftell _lseeki64 __stdio_common_vsscanf __stdio_common_vsprintf fputc _wopen fgetwc __acrt_iob_func ungetwc feof _close fclose fputwc __stdio_common_vswprintf_s _set_fmode _get_stream_buffer_pointers _fseeki64 ungetc fseek __p__commode setvbuf _read _write __stdio_common_vfprintf fread _fileno fgetpos fputs fwrite fgets _wfopen fgetc fsetpos

api-ms-win-crt-heap-l1-1-0

free malloc realloc _set_new_mode calloc _callnewh

api-ms-win-crt-filesystem-l1-1-0

_unlink _wstat64 _fstat64 _wremove _lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_strdup _stricmp wcsncpy strpbrk wcsncmp strlen strspn wcspbrk strncmp strcspn strncpy strcmp wcslen

api-ms-win-crt-convert-l1-1-0

wcstombs strtoul strtoll atoi strtol

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-math-l1-1-0

ceilf _fdopen asin acosf __setusermatherr atan2 sqrtf sqrt sinf powf fmodf cosf tanf

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale