Analysis
-
max time kernel
0s -
max time network
0s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 17:37
Behavioral task
behavioral1
Sample
Runtime Broker.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Runtime Broker.exe
Resource
win10v2004-20240508-en
25 signatures
150 seconds
General
-
Target
Runtime Broker.exe
-
Size
72KB
-
MD5
89af2aaffc3ddda07a0fc977c8bb2236
-
SHA1
412bd5812599d5729a51d0350df48030b0d04e1a
-
SHA256
637aff987be6ea158b7182de9de5de0054407077511019516270d82a6f2e9b69
-
SHA512
8c2b26d0f1b0ae80149a2aaadef329ab7fb3495bdfbccb7f8ff60368094cd955829b2cb1217b16808ac41a223661d48c2dcf88d3daeddc6b699aa88272be75ae
-
SSDEEP
1536:b0nLpERHZ5P56srqpbTXw3cYUo6IfI4WOyL6KqGi:bcY7P56tbTXb6IvOyyGi
Malware Config
Extracted
Family
xworm
C2
medical-m.gl.at.ply.gg:28857
Attributes
-
Install_directory
%ProgramData%
-
install_file
Runtime Broker.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1668-1-0x0000000000EB0000-0x0000000000EC8000-memory.dmp family_xworm -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Runtime Broker.exedescription pid process Token: SeDebugPrivilege 1668 Runtime Broker.exe