Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 11:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SysRuntimeMonitor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
SysRuntimeMonitor.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target SysRuntimeMonitor.exe
- Size 921KB
- Sample260809-njsd4szxbt
- SHA256 18c73fb58a65ef856bcdfd8b2cca78328d3f3981b38b934a237a5e3fe5757d01
- MD5 d7143e94db9692292a1fa448c9761502
- SHA1 3d1ec4e3da5cadb51ad0a6757652cd84013c7e14
- SHA512 0acce87602ac51b0cef2d7ca9e3b48cba4081ab6bbfa3b61c149409eee9063b03a195e7753572e390559d7b1c23d5e08eff0278474c92cc0800763dc2081fbca
- SSDEEP 12288:K82l/PD0DOWC7fL4NjjznFOGkQO1Xend0HXpdqnrg53aoo:3QoRC7D6jzFbKf+S3Y
- TLSH T191154C07BA6594E8D5ABC43CC6574526AA2274DB0B31A7EF12C51A1D3F26BF4AF3C300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1868 RuntimeBrokerHost.exe - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3424 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 1868 RuntimeBrokerHost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe 1868 RuntimeBrokerHost.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4416 wrote to memory of 3424 4416 SysRuntimeMonitor.exe 89 PID 4416 wrote to memory of 1868 4416 SysRuntimeMonitor.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SysRuntimeMonitor.exe"C:\Users\Admin\AppData\Local\Temp\SysRuntimeMonitor.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\system32\schtasks.exe"schtasks" /Create /F /SC ONLOGON /TN RuntimeBroker /TR \"C:\Users\Admin\AppData\Local\Temp\SysRuntimeMonitor.exe\"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3424
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBrokerHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBrokerHost.exe" --internal-supervised Local\RuntimeBrokerHost-heartbeat-4416-1786274773912 Local\RuntimeBrokerHost-heartbeat-4416-1786274773912 4416 C:\Users\Admin\AppData\Local\Temp\SysRuntimeMonitor.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1868
-
-
C:\Users\Admin\AppData\Local\Temp\SysRuntimeMonitor.exe"C:\Users\Admin\AppData\Local\Temp\SysRuntimeMonitor.exe"1⤵PID:4240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBrokerHost.exe
- Size 921KB
- SHA256 18c73fb58a65ef856bcdfd8b2cca78328d3f3981b38b934a237a5e3fe5757d01
- MD5 d7143e94db9692292a1fa448c9761502
- SHA1 3d1ec4e3da5cadb51ad0a6757652cd84013c7e14
- SHA512 0acce87602ac51b0cef2d7ca9e3b48cba4081ab6bbfa3b61c149409eee9063b03a195e7753572e390559d7b1c23d5e08eff0278474c92cc0800763dc2081fbca
- SSDEEP 12288:K82l/PD0DOWC7fL4NjjznFOGkQO1Xend0HXpdqnrg53aoo:3QoRC7D6jzFbKf+S3Y
- TLSH T191154C07BA6594E8D5ABC43CC6574526AA2274DB0B31A7EF12C51A1D3F26BF4AF3C300
- MD5 SHA1 SHA512 SSDEEP TLSH