01be18e5bd3d04c79f8db21b72c06b84e724628e24f978a98aa86b4cb5b10499

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file_37b904483beaa60e.exe
Size 268KB
Sample261017-hfxxjaytht
SHA256 01be18e5bd3d04c79f8db21b72c06b84e724628e24f978a98aa86b4cb5b10499
MD5 2cd4e1d28f455756ffd8d3d05728cf3b
SHA1 9b766cca40f5dd48da8e0552f3edd6003367c0fc
SHA512 4898c2f2bbb6c39750ccd76b77c44c70e867d6ba61afe8e155291a68d4b89a484bdf8a1f0de35abc5511ebd5d9ec17ced1444a0373c990ad00254f71d6c03169
SSDEEP 3072:hUrwe1T/9hWkwxsA1OqJLeA/SsgBmXvrVx77JQMR2/wFYcRhTI9ERy+5xSzd8waZ:hgJGtdLe4vBoMR2/yuERyfSzyhfwQzC
TLSH
T10444F603D35744F9D86AC675CAA6D233A521B8599534BA3E2B84DF223F21F10F72DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3568	RuntimeBroker_svc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	file_37b904483beaa60e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	file_37b904483beaa60e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker_svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker_svc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file_37b904483beaa60e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file_37b904483beaa60e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker_svc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker_svc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3568	RuntimeBroker_svc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 3568	5988	file_37b904483beaa60e.exe	88

C:\Users\Admin\AppData\Local\Temp\file_37b904483beaa60e.exe
"C:\Users\Admin\AppData\Local\Temp\file_37b904483beaa60e.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker_svc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe
Size 268KB
SHA256 01be18e5bd3d04c79f8db21b72c06b84e724628e24f978a98aa86b4cb5b10499
MD5 2cd4e1d28f455756ffd8d3d05728cf3b
SHA1 9b766cca40f5dd48da8e0552f3edd6003367c0fc
SHA512 4898c2f2bbb6c39750ccd76b77c44c70e867d6ba61afe8e155291a68d4b89a484bdf8a1f0de35abc5511ebd5d9ec17ced1444a0373c990ad00254f71d6c03169
SSDEEP 3072:hUrwe1T/9hWkwxsA1OqJLeA/SsgBmXvrVx77JQMR2/wFYcRhTI9ERy+5xSzd8waZ:hgJGtdLe4vBoMR2/yuERyfSzyhfwQzC
TLSH
T10444F603D35744F9D86AC675CAA6D233A521B8599534BA3E2B84DF223F21F10F72DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3568-2-0x00007FF7BCAA0000-0x00007FF7BCAEA000-memory.dmp

Download

memory/5988-1-0x00007FF763820000-0x00007FF76386A000-memory.dmp