Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 16:22
General
- Target RuntimeBroker_1.exe
- Size 12.4MB
- Sample260802-tvalbsswdy
- SHA256 3bb219205d8723dd1d9d44b0ede3d1a33ec9270361889ae4e13d72290e951db3
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"1⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe" -startup1⤵
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004A0 0x00000000000004A81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
tmpC610.wav
memory/2340-14-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/2340-17-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/2340-16-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/2340-15-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-4-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-0-0x00007FFEE571F000-0x00007FFEE5720000-memory.dmp
memory/5540-7-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-8-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-9-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-13-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-5-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-6-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-3-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-2-0x00000000002F0000-0x0000000000F60000-memory.dmp
memory/5540-21-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-22-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-23-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp
memory/5540-1-0x00007FFEE5590000-0x00007FFEE5F34000-memory.dmp