Overview

overview

7

Static

static

3

Runtime Broker.exe

windows10-2004-x64

7

Runtime Broker.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    pure.zip
  • Size 32.0MB
  • Sample260727-l36dzazemf
  • SHA256 fa1e826284672062b982bb50928f07365749b77827db171394be3d07a89ec6da
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionspywarestealer

Malware Config

Targets

    • Target
      Runtime Broker.exe
    • Size 71.3MB
    • SHA256 2e05d97ed7bfabea8f7370ba627e0705ec2c0fbf3974b39437e9d95d45d1a76d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    executionspywarestealer

    • Drops startup file

    • Executes a VBScript file via the Windows Script Host.

      execution

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks