Report - RuntimeBroker.exe

Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) UPX PE32 PE File MZP Format OS Processor Check
ScreenShot
Created 2024.02.22 11:54 Machine s1_win7_x6403
Filename RuntimeBroker.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
Behavior Score
4.0
ZERO API file : clean
VT API (file) 51 detected (Common, malicious, high confidence, score, Strictor, unsafe, V8dd, GenericKD, Attribute, HighConfidence, Artemis, DropperX, fbob, bLHpRFEdQiL, gujqj, R002C0XAL24, Detected, ai score=86, Malware@#1oes9mcdwsmah, Casdet, ABRisk, EDTB, R627333, ZexaF, XN0@aWNhUYci, Chgt, Gencirc, YPOPBlWAx+k, susgen, confidence, 100%)
md5 75484c429d668b95a287bde3ebb46fc8
sha256 ec36ebae6ef6f254f20c4a444c17db05be30a0acbbaf33f5f568608a38452d7c
ssdeep 49152:kqSp+PMNVDyr1xqLjhZzYhiSwMmNnuwYN1GCJZZ6ev3EHbfUFr6P:kZp+kLD4TqLjfLFCDJZZnEMFWP
imphash e7027585a1e3cec2bbf81c4b0fdf2b04
impfuzzy 192:DJ97JQxdet6sRFj7txfhHB8d1omi8BzfUhnDut5XPQOD:b7JQxItVj7thLAB8arPQOD
  Network IP location

Signature (8cnts)

Level Description
danger File has been identified by 51 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
watch Detects the presence of Wine emulator
notice Allocates read-write-execute memory (usually to unpack itself)
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (8cnts)

Level Name Description Collection
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://89.39.107.226/?connect=try NL WorldStream B.V. 89.39.107.226 clean
http://89.39.107.226/?connect=logs&data=LAUNCH NL WorldStream B.V. 89.39.107.226 clean
http://89.39.107.226/?connect=try&action=refresh NL WorldStream B.V. 89.39.107.226 clean
89.39.107.226 NL WorldStream B.V. 89.39.107.226 clean

Suricata ids

PE API

IAT(Import Address Table) Library

ADVAPI32.DLL
 0x7731c8 GetUserNameW
 0x7731cc RegCloseKey
 0x7731d0 RegConnectRegistryW
 0x7731d4 RegCreateKeyExW
 0x7731d8 RegDeleteKeyW
 0x7731dc RegDeleteValueW
 0x7731e0 RegEnumKeyExW
 0x7731e4 RegEnumValueW
 0x7731e8 RegFlushKey
 0x7731ec RegLoadKeyW
 0x7731f0 RegOpenKeyExW
 0x7731f4 RegQueryInfoKeyW
 0x7731f8 RegQueryValueExW
 0x7731fc RegReplaceKeyW
 0x773200 RegRestoreKeyW
 0x773204 RegSaveKeyW
 0x773208 RegSetValueExW
 0x77320c RegUnLoadKeyW
KERNEL32.DLL
 0x773468 CloseHandle
 0x77346c CompareStringW
 0x773470 CreateEventW
 0x773474 CreateFileA
 0x773478 CreateFileW
 0x77347c CreateMutexA
 0x773480 CreateSemaphoreA
 0x773484 CreateThread
 0x773488 DeleteCriticalSection
 0x77348c DeleteFileA
 0x773490 DeleteFileW
 0x773494 DuplicateHandle
 0x773498 EnterCriticalSection
 0x77349c EnumCalendarInfoW
 0x7734a0 EnumResourceNamesW
 0x7734a4 EnumSystemLocalesW
 0x7734a8 ExitProcess
 0x7734ac ExitThread
 0x7734b0 FileTimeToDosDateTime
 0x7734b4 FileTimeToLocalFileTime
 0x7734b8 FindClose
 0x7734bc FindFirstFileW
 0x7734c0 FindNextFileW
 0x7734c4 FindResourceW
 0x7734c8 FormatMessageW
 0x7734cc FreeEnvironmentStringsA
 0x7734d0 FreeEnvironmentStringsW
 0x7734d4 FreeLibrary
 0x7734d8 FreeResource
 0x7734dc GetACP
 0x7734e0 GetCPInfo
 0x7734e4 GetCPInfoExW
 0x7734e8 GetCommandLineW
 0x7734ec GetComputerNameW
 0x7734f0 GetCurrentProcess
 0x7734f4 GetCurrentProcessId
 0x7734f8 GetCurrentThread
 0x7734fc GetCurrentThreadId
 0x773500 GetDateFormatW
 0x773504 GetDiskFreeSpaceW
 0x773508 GetEnvironmentStrings
 0x77350c GetEnvironmentStringsW
 0x773510 GetEnvironmentVariableW
 0x773514 GetExitCodeThread
 0x773518 GetFileAttributesA
 0x77351c GetFileAttributesW
 0x773520 GetFileSize
 0x773524 GetFileType
 0x773528 GetFullPathNameW
 0x77352c GetLastError
 0x773530 GetLocalTime
 0x773534 GetLocaleInfoA
 0x773538 GetLocaleInfoW
 0x77353c GetModuleFileNameA
 0x773540 GetModuleFileNameW
 0x773544 GetModuleHandleA
 0x773548 GetModuleHandleW
 0x77354c GetOEMCP
 0x773550 GetProcAddress
 0x773554 GetProcessHeap
 0x773558 GetStartupInfoA
 0x77355c GetStartupInfoW
 0x773560 GetStdHandle
 0x773564 GetStringTypeA
 0x773568 GetStringTypeW
 0x77356c GetSystemDefaultLangID
 0x773570 GetSystemDefaultUILanguage
 0x773574 GetSystemInfo
 0x773578 GetSystemTimeAsFileTime
 0x77357c GetTempPathW
 0x773580 GetThreadLocale
 0x773584 GetThreadPriority
 0x773588 GetTickCount
 0x77358c GetTimeZoneInformation
 0x773590 GetUserDefaultLCID
 0x773594 GetUserDefaultUILanguage
 0x773598 GetVersion
 0x77359c GetVersionExA
 0x7735a0 GetVersionExW
 0x7735a4 GlobalAddAtomW
 0x7735a8 GlobalAlloc
 0x7735ac GlobalDeleteAtom
 0x7735b0 GlobalFindAtomW
 0x7735b4 GlobalFree
 0x7735b8 GlobalLock
 0x7735bc GlobalUnlock
 0x7735c0 HeapAlloc
 0x7735c4 HeapCreate
 0x7735c8 HeapDestroy
 0x7735cc HeapFree
 0x7735d0 InitializeCriticalSection
 0x7735d4 IsDBCSLeadByteEx
 0x7735d8 IsDebuggerPresent
 0x7735dc IsValidLocale
 0x7735e0 LCMapStringA
 0x7735e4 LCMapStringW
 0x7735e8 LeaveCriticalSection
 0x7735ec LoadLibraryA
 0x7735f0 LoadLibraryExW
 0x7735f4 LoadLibraryW
 0x7735f8 LoadResource
 0x7735fc LocalAlloc
 0x773600 LocalFree
 0x773604 LockResource
 0x773608 MulDiv
 0x77360c MultiByteToWideChar
 0x773610 QueryPerformanceCounter
 0x773614 QueryPerformanceFrequency
 0x773618 RaiseException
 0x77361c ReadFile
 0x773620 ReleaseMutex
 0x773624 ReleaseSemaphore
 0x773628 RemoveDirectoryW
 0x77362c ResetEvent
 0x773630 ResumeThread
 0x773634 RtlUnwind
 0x773638 SetConsoleCtrlHandler
 0x77363c SetEndOfFile
 0x773640 SetErrorMode
 0x773644 SetEvent
 0x773648 SetFilePointer
 0x77364c SetHandleCount
 0x773650 SetLastError
 0x773654 SetThreadLocale
 0x773658 SetThreadPriority
 0x77365c SizeofResource
 0x773660 Sleep
 0x773664 SuspendThread
 0x773668 SwitchToThread
 0x77366c TlsAlloc
 0x773670 TlsFree
 0x773674 TlsGetValue
 0x773678 TlsSetValue
 0x77367c TryEnterCriticalSection
 0x773680 UnhandledExceptionFilter
 0x773684 VerSetConditionMask
 0x773688 VerifyVersionInfoW
 0x77368c VirtualAlloc
 0x773690 VirtualFree
 0x773694 VirtualQuery
 0x773698 VirtualQueryEx
 0x77369c WaitForMultipleObjectsEx
 0x7736a0 WaitForSingleObject
 0x7736a4 WaitForSingleObjectEx
 0x7736a8 WideCharToMultiByte
 0x7736ac WriteFile
 0x7736b0 lstrcmpW
 0x7736b4 lstrlenW
VERSION.DLL
 0x7736cc GetFileVersionInfoSizeW
 0x7736d0 GetFileVersionInfoW
 0x7736d4 VerQueryValueW
WINSPOOL.DRV
 0x7736f4 ClosePrinter
 0x7736f8 DocumentPropertiesW
 0x7736fc EnumPrintersW
 0x773700 None
 0x773704 OpenPrinterW
COMCTL32.DLL
 0x7737a4 FlatSB_GetScrollInfo
 0x7737a8 FlatSB_GetScrollPos
 0x7737ac FlatSB_SetScrollInfo
 0x7737b0 FlatSB_SetScrollPos
 0x7737b4 FlatSB_SetScrollProp
 0x7737b8 ImageList_Add
 0x7737bc ImageList_BeginDrag
 0x7737c0 ImageList_Copy
 0x7737c4 ImageList_Create
 0x7737c8 ImageList_Destroy
 0x7737cc ImageList_DragEnter
 0x7737d0 ImageList_DragLeave
 0x7737d4 ImageList_DragMove
 0x7737d8 ImageList_DragShowNolock
 0x7737dc ImageList_Draw
 0x7737e0 ImageList_DrawEx
 0x7737e4 ImageList_DrawIndirect
 0x7737e8 ImageList_EndDrag
 0x7737ec ImageList_GetBkColor
 0x7737f0 ImageList_GetDragImage
 0x7737f4 ImageList_GetIcon
 0x7737f8 ImageList_GetIconSize
 0x7737fc ImageList_GetImageCount
 0x773800 ImageList_GetImageInfo
 0x773804 ImageList_LoadImageW
 0x773808 ImageList_Read
 0x77380c ImageList_Remove
 0x773810 ImageList_Replace
 0x773814 ImageList_ReplaceIcon
 0x773818 ImageList_SetBkColor
 0x77381c ImageList_SetIconSize
 0x773820 ImageList_SetImageCount
 0x773824 ImageList_SetOverlayImage
 0x773828 ImageList_Write
 0x77382c None
 0x773830 InitializeFlatSB
 0x773834 _TrackMouseEvent
COMDLG32.DLL
 0x773844 FindTextW
GDI32.DLL
 0x7739e4 AbortDoc
 0x7739e8 AngleArc
 0x7739ec Arc
 0x7739f0 ArcTo
 0x7739f4 BitBlt
 0x7739f8 Chord
 0x7739fc CombineRgn
 0x773a00 CopyEnhMetaFileW
 0x773a04 CreateBitmap
 0x773a08 CreateBrushIndirect
 0x773a0c CreateCompatibleBitmap
 0x773a10 CreateCompatibleDC
 0x773a14 CreateDCW
 0x773a18 CreateDIBSection
 0x773a1c CreateDIBitmap
 0x773a20 CreateFontIndirectW
 0x773a24 CreateHalftonePalette
 0x773a28 CreateICW
 0x773a2c CreatePalette
 0x773a30 CreatePenIndirect
 0x773a34 CreateRectRgn
 0x773a38 CreateSolidBrush
 0x773a3c DeleteDC
 0x773a40 DeleteEnhMetaFile
 0x773a44 DeleteObject
 0x773a48 Ellipse
 0x773a4c EndDoc
 0x773a50 EndPage
 0x773a54 EnumFontFamiliesExW
 0x773a58 EnumFontsW
 0x773a5c ExcludeClipRect
 0x773a60 ExtFloodFill
 0x773a64 ExtTextOutW
 0x773a68 FrameRgn
 0x773a6c GdiFlush
 0x773a70 GetBitmapBits
 0x773a74 GetBrushOrgEx
 0x773a78 GetClipBox
 0x773a7c GetCurrentPositionEx
 0x773a80 GetDIBColorTable
 0x773a84 GetDIBits
 0x773a88 GetDeviceCaps
 0x773a8c GetEnhMetaFileBits
 0x773a90 GetEnhMetaFileDescriptionW
 0x773a94 GetEnhMetaFileHeader
 0x773a98 GetEnhMetaFilePaletteEntries
 0x773a9c GetObjectW
 0x773aa0 GetPaletteEntries
 0x773aa4 GetPixel
 0x773aa8 GetRgnBox
 0x773aac GetStockObject
 0x773ab0 GetStretchBltMode
 0x773ab4 GetSystemPaletteEntries
 0x773ab8 GetTextExtentPoint32W
 0x773abc GetTextExtentPointW
 0x773ac0 GetTextMetricsW
 0x773ac4 GetWinMetaFileBits
 0x773ac8 GetWindowOrgEx
 0x773acc IntersectClipRect
 0x773ad0 LineTo
 0x773ad4 MaskBlt
 0x773ad8 MoveToEx
 0x773adc PatBlt
 0x773ae0 Pie
 0x773ae4 PlayEnhMetaFile
 0x773ae8 PolyBezier
 0x773aec PolyBezierTo
 0x773af0 Polygon
 0x773af4 Polyline
 0x773af8 RealizePalette
 0x773afc RectVisible
 0x773b00 Rectangle
 0x773b04 RestoreDC
 0x773b08 RoundRect
 0x773b0c SaveDC
 0x773b10 SelectClipRgn
 0x773b14 SelectObject
 0x773b18 SelectPalette
 0x773b1c SetAbortProc
 0x773b20 SetBkColor
 0x773b24 SetBkMode
 0x773b28 SetBrushOrgEx
 0x773b2c SetDIBColorTable
 0x773b30 SetDIBits
 0x773b34 SetEnhMetaFileBits
 0x773b38 SetMapMode
 0x773b3c SetPixel
 0x773b40 SetROP2
 0x773b44 SetRectRgn
 0x773b48 SetStretchBltMode
 0x773b4c SetTextColor
 0x773b50 SetViewportOrgEx
 0x773b54 SetWinMetaFileBits
 0x773b58 SetWindowOrgEx
 0x773b5c StartDocW
 0x773b60 StartPage
 0x773b64 StretchBlt
 0x773b68 StretchDIBits
 0x773b6c UnrealizeObject
SHELL32.DLL
 0x773b8c SHAppBarMessage
 0x773b90 ShellExecuteW
 0x773b94 Shell_NotifyIconW
USER32.DLL
 0x773ea0 ActivateKeyboardLayout
 0x773ea4 AdjustWindowRectEx
 0x773ea8 BeginPaint
 0x773eac BringWindowToTop
 0x773eb0 CallNextHookEx
 0x773eb4 CallWindowProcW
 0x773eb8 CharLowerBuffW
 0x773ebc CharLowerW
 0x773ec0 CharNextW
 0x773ec4 CharUpperBuffW
 0x773ec8 CharUpperW
 0x773ecc CheckMenuItem
 0x773ed0 ChildWindowFromPoint
 0x773ed4 ClientToScreen
 0x773ed8 CloseClipboard
 0x773edc CopyIcon
 0x773ee0 CopyImage
 0x773ee4 CreateAcceleratorTableW
 0x773ee8 CreateIcon
 0x773eec CreateIconIndirect
 0x773ef0 CreateMenu
 0x773ef4 CreatePopupMenu
 0x773ef8 CreateWindowExW
 0x773efc DefFrameProcW
 0x773f00 DefMDIChildProcW
 0x773f04 DefWindowProcW
 0x773f08 DeleteMenu
 0x773f0c DestroyCursor
 0x773f10 DestroyIcon
 0x773f14 DestroyMenu
 0x773f18 DestroyWindow
 0x773f1c DispatchMessageA
 0x773f20 DispatchMessageW
 0x773f24 DrawEdge
 0x773f28 DrawFocusRect
 0x773f2c DrawFrameControl
 0x773f30 DrawIcon
 0x773f34 DrawIconEx
 0x773f38 DrawMenuBar
 0x773f3c DrawTextExW
 0x773f40 DrawTextW
 0x773f44 EmptyClipboard
 0x773f48 EnableMenuItem
 0x773f4c EnableScrollBar
 0x773f50 EnableWindow
 0x773f54 EndMenu
 0x773f58 EndPaint
 0x773f5c EnumChildWindows
 0x773f60 EnumDisplayMonitors
 0x773f64 EnumThreadWindows
 0x773f68 EnumWindows
 0x773f6c FillRect
 0x773f70 FindWindowExW
 0x773f74 FindWindowW
 0x773f78 FrameRect
 0x773f7c GetActiveWindow
 0x773f80 GetCapture
 0x773f84 GetClassInfoW
 0x773f88 GetClassLongW
 0x773f8c GetClassNameW
 0x773f90 GetClientRect
 0x773f94 GetClipboardData
 0x773f98 GetCursor
 0x773f9c GetCursorPos
 0x773fa0 GetDC
 0x773fa4 GetDCEx
 0x773fa8 GetDesktopWindow
 0x773fac GetDlgCtrlID
 0x773fb0 GetFocus
 0x773fb4 GetForegroundWindow
 0x773fb8 GetIconInfo
 0x773fbc GetKeyNameTextW
 0x773fc0 GetKeyState
 0x773fc4 GetKeyboardLayout
 0x773fc8 GetKeyboardLayoutList
 0x773fcc GetKeyboardLayoutNameW
 0x773fd0 GetKeyboardState
 0x773fd4 GetLastActivePopup
 0x773fd8 GetMenu
 0x773fdc GetMenuItemCount
 0x773fe0 GetMenuItemID
 0x773fe4 GetMenuItemInfoW
 0x773fe8 GetMenuState
 0x773fec GetMenuStringW
 0x773ff0 GetMessageExtraInfo
 0x773ff4 GetMessagePos
 0x773ff8 GetMonitorInfoW
 0x773ffc GetParent
 0x774000 GetPropW
 0x774004 GetScrollBarInfo
 0x774008 GetScrollInfo
 0x77400c GetScrollPos
 0x774010 GetScrollRange
 0x774014 GetSubMenu
 0x774018 GetSysColor
 0x77401c GetSysColorBrush
 0x774020 GetSystemMenu
 0x774024 GetSystemMetrics
 0x774028 GetTopWindow
 0x77402c GetUpdateRect
 0x774030 GetWindow
 0x774034 GetWindowDC
 0x774038 GetWindowLongW
 0x77403c GetWindowPlacement
 0x774040 GetWindowRect
 0x774044 GetWindowTextW
 0x774048 GetWindowThreadProcessId
 0x77404c HideCaret
 0x774050 InsertMenuItemW
 0x774054 InsertMenuW
 0x774058 InvalidateRect
 0x77405c IsChild
 0x774060 IsDialogMessageA
 0x774064 IsDialogMessageW
 0x774068 IsIconic
 0x77406c IsWindow
 0x774070 IsWindowEnabled
 0x774074 IsWindowUnicode
 0x774078 IsWindowVisible
 0x77407c IsZoomed
 0x774080 KillTimer
 0x774084 LoadBitmapW
 0x774088 LoadCursorW
 0x77408c LoadIconW
 0x774090 LoadKeyboardLayoutW
 0x774094 LoadStringW
 0x774098 LockWindowUpdate
 0x77409c MapVirtualKeyW
 0x7740a0 MapWindowPoints
 0x7740a4 MessageBeep
 0x7740a8 MessageBoxW
 0x7740ac MonitorFromPoint
 0x7740b0 MonitorFromRect
 0x7740b4 MonitorFromWindow
 0x7740b8 MoveWindow
 0x7740bc MsgWaitForMultipleObjects
 0x7740c0 MsgWaitForMultipleObjectsEx
 0x7740c4 OpenClipboard
 0x7740c8 PeekMessageA
 0x7740cc PeekMessageW
 0x7740d0 PostMessageW
 0x7740d4 PostQuitMessage
 0x7740d8 RedrawWindow
 0x7740dc RegisterClassW
 0x7740e0 RegisterClipboardFormatW
 0x7740e4 RegisterWindowMessageW
 0x7740e8 ReleaseCapture
 0x7740ec ReleaseDC
 0x7740f0 RemoveMenu
 0x7740f4 RemovePropW
 0x7740f8 ScreenToClient
 0x7740fc ScrollWindow
 0x774100 SendMessageA
 0x774104 SendMessageW
 0x774108 SetActiveWindow
 0x77410c SetCapture
 0x774110 SetClassLongW
 0x774114 SetClipboardData
 0x774118 SetCursor
 0x77411c SetCursorPos
 0x774120 SetFocus
 0x774124 SetForegroundWindow
 0x774128 SetMenu
 0x77412c SetMenuItemInfoW
 0x774130 SetParent
 0x774134 SetPropW
 0x774138 SetRect
 0x77413c SetScrollInfo
 0x774140 SetScrollPos
 0x774144 SetScrollRange
 0x774148 SetTimer
 0x77414c SetWindowLongW
 0x774150 SetWindowPlacement
 0x774154 SetWindowPos
 0x774158 SetWindowRgn
 0x77415c SetWindowTextW
 0x774160 SetWindowsHookExW
 0x774164 ShowCaret
 0x774168 ShowOwnedPopups
 0x77416c ShowScrollBar
 0x774170 ShowWindow
 0x774174 SystemParametersInfoW
 0x774178 TrackPopupMenu
 0x77417c TranslateMDISysAccel
 0x774180 TranslateMessage
 0x774184 UnhookWindowsHookEx
 0x774188 UnregisterClassW
 0x77418c UpdateWindow
 0x774190 ValidateRect
 0x774194 WaitMessage
 0x774198 WindowFromPoint
 0x77419c wsprintfA
OLE32.DLL
 0x7741d0 CoCreateInstance
 0x7741d4 CoInitialize
 0x7741d8 CoTaskMemAlloc
 0x7741dc CoTaskMemFree
 0x7741e0 CoUninitialize
 0x7741e4 IsEqualGUID
 0x7741e8 OleInitialize
 0x7741ec OleUninitialize
OLEAUT32.DLL
 0x774228 GetErrorInfo
 0x77422c SafeArrayCreate
 0x774230 SafeArrayGetLBound
 0x774234 SafeArrayGetUBound
 0x774238 SafeArrayPtrOfIndex
 0x77423c SysAllocStringLen
 0x774240 SysFreeString
 0x774244 SysReAllocStringLen
 0x774248 VariantChangeType
 0x77424c VariantClear
 0x774250 VariantCopy
 0x774254 VariantInit

EAT(Export Address Table) Library

0x40e3d8 @$xp$6TForm2
0x40e420 @@Unit2@Finalize
0x40e3fc @@Unit2@Initialize
0x75c418 _Form2
0x74b0b0 ___CPPdebugHook
0x7439c0 ___setRaiseListFuncAddr
0x403308 __dbk_fcall_wrapper
0x75c3e0 dbkFCallWrapperAddr


Similarity measure (PE file only) - Checking for service failure