RuntimeBroker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RuntimeBroker.exe
Size 28.5MB
Sample261030-tekflaeh78
SHA256 da3e1bc7ff90b429f063f44d4490c2558a571acde651afc6f4955df3a1f16c1f
MD5 6ba45524753ab443789f24214853c9d8
SHA1 32f5fb0cf1e0f30d9d174be347a39055d32e20b2
SHA512 e96ff2845182120cec8a65b4e95b80c438940dcf2c13d90e3a50eb2a237a8067b567e39d96789b4cb98cbd89690b414089404f127b5f2ba8698a6bf96f2fae72
SSDEEP 393216:0E9cVXY6XTvEdFwzKb3Dpgmuw1ofKFjO9:05I+vE3wzeO
TLSH
T114672926914E653DE116B1B4D2AACF2BC7F8BC0A5124EE961AC1CD33190F997FF60943
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RuntimeBroker.exe

File Explorer

RuntimeBroker.exe

.exe 28.5MB

RuntimeBroker.exe

IMPHASH 5526f2365be9b3b1f879dd62df55e494
SHA256 da3e1bc7ff90b429f063f44d4490c2558a571acde651afc6f4955df3a1f16c1f
MD5 6ba45524753ab443789f24214853c9d8
SHA1 32f5fb0cf1e0f30d9d174be347a39055d32e20b2
SHA512 e96ff2845182120cec8a65b4e95b80c438940dcf2c13d90e3a50eb2a237a8067b567e39d96789b4cb98cbd89690b414089404f127b5f2ba8698a6bf96f2fae72
SSDEEP 393216:0E9cVXY6XTvEdFwzKb3Dpgmuw1ofKFjO9:05I+vE3wzeO
TLSH
T114672926914E653DE116B1B4D2AACF2BC7F8BC0A5124EE961AC1CD33190F997FF60943
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19552320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitializeCriticalSectionEx DeleteCriticalSection CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW GetModuleHandleW QueryFullProcessImageNameW EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW LoadLibraryW SleepEx InitializeCriticalSection LocalFree MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType HeapReAlloc HeapDestroy AddVectoredExceptionHandler CreateFileW FormatMessageW SetLastError AcquireSRWLockExclusive QueryPerformanceCounter HeapSize VerSetConditionMask QueryPerformanceFrequency GetLocaleInfoA WideCharToMultiByte GlobalFree GlobalAlloc GetLastError PeekNamedPipe WaitForMultipleObjects Sleep GetExitCodeProcess VerifyVersionInfoW GetFileSizeEx GetProcessHeap HeapAlloc FreeConsole CreateFileA HeapFree ReadFile GlobalUnlock CreateProcessA GlobalLock DeleteFileA FindClose FindNextFileA FindFirstFileA DuplicateHandle GetProcessId FreeLibrary GetCurrentProcessId Process32Next MultiByteToWideChar SetThreadPriority GetCurrentProcess SetDefaultDllDirectories SetPriorityClass Process32First GetModuleFileNameA CheckRemoteDebuggerPresent IsDebuggerPresent OpenThread IsBadReadPtr CreateRemoteThread ExitProcess GetThreadContext QueueUserAPC CreateThread CloseHandle LoadLibraryA GetCurrentThread GetTempPathA CreateToolhelp32Snapshot SleepConditionVariableSRW GetCurrentThreadId FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW OpenProcess Module32First WaitForSingleObject Module32Next TerminateProcess VirtualAlloc VirtualProtect CreateRemoteThreadEx GetProcAddress GetModuleHandleA GetTickCount64 GetTickCount VirtualQueryEx VirtualFreeEx ReadProcessMemory VirtualAllocEx VirtualProtectEx GetSystemInfo WriteProcessMemory ReleaseSRWLockExclusive

user32

GetKeyState GetMessageExtraInfo ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout SetCapture SetCursor IsWindowUnicode FindWindowA GetAsyncKeyState GetWindowTextLengthA SetWindowsHookA FindWindowW GetWindowTextA GetClassNameA IsWindowVisible EnumWindows MessageBoxA MessageBoxW GetWindowThreadProcessId GetClipboardData GetForegroundWindow CloseClipboard OpenClipboard mouse_event ReleaseCapture EmptyClipboard SetClipboardData keybd_event DispatchMessageA GetWindowRect LoadCursorA DestroyWindow SetWindowPos SetActiveWindow GetSystemMetrics ShowWindow IsWindow SetWindowLongA ClientToScreen GetWindowLongA SetWindowDisplayAffinity DefWindowProcA CreateWindowExA GetCursorPos SetFocus TranslateMessage SetCursorPos ShowCursor SetForegroundWindow UpdateWindow RegisterClassExA PostQuitMessage UnregisterClassA PeekMessageA GetClientRect ClipCursor SetLayeredWindowAttributes

comdlg32

GetOpenFileNameA

advapi32

CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidA CopySid SetSecurityInfo RegDeleteKeyA RegCreateKeyExA IsValidSid InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce OpenProcessToken RegGetValueA OpenServiceA ControlService OpenSCManagerA CloseServiceHandle QueryServiceStatus RegEnumKeyExA RegDeleteValueA CryptImportKey CryptEncrypt SystemFunction036 RegEnumValueA RegOpenKeyExA RegCloseKey RegDeleteTreeA

shell32

ShellExecuteA SHChangeNotify

ole32

CoCreateInstance CoInitialize

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Random_device@std@@YAIXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Thrd_id _Thrd_join ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??Bios_base@std@@QEBA_NXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Xtime_get_ticks ??7ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z __crtLCMapStringA ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z _Query_perf_frequency ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm ?_Throw_Cpp_error@std@@YAXH@Z ??1facet@locale@std@@MEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_unlock _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

ntohs WSASetLastError getpeername getsockname WSAIoctl freeaddrinfo WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt __WSAFDIsSet select inet_pton connect recvfrom htonl htons sendto inet_ntop ioctlsocket recv WSACleanup accept bind gethostname socket closesocket send listen getaddrinfo WSAStartup setsockopt

winmm

timeEndPeriod mciSendStringA timeBeginPeriod

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory NtReadVirtualMemory NtWriteVirtualMemory

crypt32

CertFreeCertificateContext CryptDecodeObjectEx CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptStringToBinaryW PFXImportCertStore CertFindExtension CertAddCertificateContextToStore CertGetNameStringW CertFindCertificateInStore CertFreeCertificateChain CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptFinishHash BCryptCreateHash BCryptGenRandom BCryptGetProperty BCryptOpenAlgorithmProvider

psapi

GetModuleInformation

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect

shlwapi

PathFindFileNameW

d3dcompiler_47

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

avrt

AvSetMmThreadCharacteristicsA AvSetMmThreadPriority

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memchr memcmp memmove wcschr __current_exception __current_exception_context __C_specific_handler memset memcpy strrchr __RTtypeid strchr __std_type_info_compare __std_terminate __std_exception_copy __std_exception_destroy strstr

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode malloc calloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment __sys_errlist _register_onexit_function system _initialize_onexit_table __sys_nerr _c_exit _get_narrow_winmain_command_line _exit _configure_narrow_argv abort exit _initterm_e _initterm _resetstkoflw _beginthreadex _invalid_parameter_noinfo_noreturn _errno terminate _invalid_parameter_noinfo _set_app_type _seh_filter_exe _cexit _crt_atexit _register_thread_local_exe_atexit_callback

api-ms-win-crt-time-l1-1-0

strftime _localtime64 _time64 _gmtime64

api-ms-win-crt-string-l1-1-0

strncpy strlen strcpy _stricmp strnlen toupper isalpha isdigit strcpy_s isxdigit _wcsdup strcspn strncmp wcspbrk wcslen strcmp tolower isalnum wcsncmp strpbrk wcsncpy strspn _strdup

api-ms-win-crt-convert-l1-1-0

strtoull strtol strtod strtoul strtof strtoll atoi wcstombs

api-ms-win-crt-stdio-l1-1-0

feof fflush fgetc __acrt_iob_func fputc __stdio_common_vfprintf fseek fwrite ftell __stdio_common_vsprintf __stdio_common_vsscanf ungetc fgetpos setvbuf _wfopen fclose _close _fileno _write _read __p__commode _set_fmode _lseeki64 fgets __stdio_common_vsprintf_s fopen _pclose _popen _wopen _get_stream_buffer_pointers _fseeki64 fread fsetpos fputs

api-ms-win-crt-math-l1-1-0

cosf _dsign ldexp _hypotf __setusermatherr ceilf tanf asinf powf sqrtf sinf acosf atan2f expf roundf _fdopen fmodf

api-ms-win-crt-filesystem-l1-1-0

remove _lock_file _unlock_file _wstat64 _unlink _fstat64

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv