Windows Analysis Report
WiezmDFd6L.exe

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Command line argument: Np

3_2_00EB6F90

Source: WiezmDFd6L.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: WiezmDFd6L.exe	Virustotal: Detection: 44%
Source: WiezmDFd6L.exe	ReversingLabs: Detection: 47%

Source: RuntimeBrokers.exe	String found in binary or memory: --StartTask
Source: RuntimeBrokers.exe	String found in binary or memory: --InstallTask
Source: RuntimeBrokers.exe	String found in binary or memory: --stop
Source: RuntimeBrokers.exe	String found in binary or memory: --start
Source: RuntimeBrokers.exe	String found in binary or memory: --install
Source: RuntimeBrokers.exe	String found in binary or memory: /launch CrashRestart

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

File read: C:\Users\user\Desktop\WiezmDFd6L.exe

Source: unknown	Process created: C:\Users\user\Desktop\WiezmDFd6L.exe "C:\Users\user\Desktop\WiezmDFd6L.exe"
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to behavior

Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: libcurl.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: chiomsStup.exe.lnk.3.dr

LNK file: ..\..\Public\Bilite\chiomsStup.exe

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: WiezmDFd6L.exe

Static file information: File size 37394506 > 1048576

Source:	Binary string: UpdaterSetup.exe.pdb source: WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \YSS\Release\libcurl.pdb source: WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, 00000003.00000002.4133195724.000000006CAFA000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: G:\ZCSD\XZRecordAlone\xzrecordalone\Release\XZCalendarServer.pdb source: WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, 00000003.00000002.4132139215.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000003.00000000.1722836156.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: UpdaterSetup.exe.pdbP source: WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: updater.exe.pdb source: WiezmDFd6L.exe, 00000000.00000003.1718878797.00000000034D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: updater.exe.pdbP source: WiezmDFd6L.exe, 00000000.00000003.1718878797.00000000034D1000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: libcurl.dll.0.dr	Static PE information: section name: .00cfg
Source: chiomsStup.exe.0.dr	Static PE information: section name: CPADinfo
Source: chiomsStup.exe.0.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Code function: 0_2_00411C20 push eax; ret	0_2_00411C4E
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E7C7E6 push ecx; ret	3_2_00E7C7F9
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E7BEE2 push ecx; ret	3_2_00E7BEF5
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C97F770 push eax; mov dword ptr [esp], 8007000Eh	3_2_6C97F774
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C9C0E84 pushfd ; retf	3_2_6C9C0E85
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C98FDC3 push esi; ret	3_2_6C98FDC5
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C99F74D push ecx; ret	3_2_6C99F760

Source: C:\Users\user\Desktop\WiezmDFd6L.exe	File created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to dropped file
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	File created: C:\Users\Public\Bilite\chiomsStup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	File created: C:\Users\Public\Bilite\Axialis\libcurl.dll	Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00E4B479 _strrchr,_strrchr,GetConsoleWindow,ShowWindow,CoInitializeEx,StartServiceCtrlDispatcherW,OpenEventW,GetProcAddress,GetProcAddress,FreeLibrary,CoUninitialize,

3_2_00E4B479

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C98E96E IsIconic,	3_2_6C98E96E
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C9B87C4 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	3_2_6C9B87C4
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C9A307D GetParent,IsIconic,GetParent,__EH_prolog3,	3_2_6C9A307D
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C9872DF IsIconic,IsWindowVisible,	3_2_6C9872DF
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C9932E4 IsWindowVisible,IsIconic,	3_2_6C9932E4

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00E7A6B0 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00E7A6B0

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

Process information set: NOOPENFILEERRORBOX

Query firmware table information (likely to detect VMs)

Malware Analysis System Evasion

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

System information queried: FirmwareTableInformation

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00E42690 _strrchr,_strrchr,RegOpenKeyExW,RegCloseKey,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,lstrcmpW,lstrcmpW,lstrcmpW,Process32NextW,CloseHandle,ShellExecuteExW,Sleep,ShellExecuteExW,

3_2_00E42690

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,

3_2_00E76390

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 840	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 3801	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 3414	Jump to behavior

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

Dropped PE file which has not been started: C:\Users\Public\Bilite\chiomsStup.exe

Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_3-132004
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_3-128237

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

API coverage: 6.1 %

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 7460	Thread sleep time: -73000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 7456	Thread sleep time: -2520000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 7456	Thread sleep time: -10242000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Code function: 0_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	0_2_0040301A
Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Code function: 0_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402B79
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E4BE70 GetLocalTime,FindFirstFileA,FindNextFileA,DeleteFileA,FindNextFileA,__Mtx_destroy_in_situ,__Mtx_destroy_in_situ,	3_2_00E4BE70
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C9C82CF __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,	3_2_6C9C82CF
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6CADF2EC FindFirstFileExW,RevokeDragDrop,FindNextFileW,FindClose,FindClose,	3_2_6CADF2EC
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6CADF23B FindFirstFileExW,	3_2_6CADF23B

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00E660C2 PostMessageW,__Mtx_unlock,GetModuleHandleW,GetSystemInfo,_strrchr,_strrchr,curl_slist_free_all,_strrchr,_strrchr,__Mtx_unlock,_strrchr,_strrchr,_strrchr,_strrchr,__Mtx_unlock,__Mtx_unlock,_strrchr,_strrchr,PostMessageW,PostMessageW,__Mtx_unlock,__Mtx_unlock,

3_2_00E660C2

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Thread delayed: delay time: 73000

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00E7C411 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00E7C411

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_6C981028 OutputDebugStringA,GetLastError,

3_2_6C981028

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

3_2_00E42690

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00EA46B3 mov eax, dword ptr fs:[00000030h]

3_2_00EA46B3

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00EB0408 GetProcessHeap,

3_2_00EB0408

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E7C128 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00E7C128
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E7C411 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00E7C411
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E7C5A4 SetUnhandledExceptionFilter,	3_2_00E7C5A4
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E9655F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00E9655F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C9F87A6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C9F87A6
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6CAD1F38 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CAD1F38
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_6C99D796 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C99D796

Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe			Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00E3245C _strrchr,_strrchr,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateEventW,_strrchr,_strrchr,GetModuleHandleW,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,WaitForSingleObject,PeekMessageW,TranslateMessage,DispatchMessageW,WaitForSingleObject,WaitForSingleObject,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,curl_global_cleanup,MoveFileExW,_strrchr,_strrchr,

3_2_00E3245C

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

Code function: 0_2_0040D72E cpuid

0_2_0040D72E

Source: C:\Users\user\Desktop\WiezmDFd6L.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,	0_2_00401F9D
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	3_2_00EB216F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	3_2_00EB22FE
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	3_2_00EB2263
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	3_2_00EB2218
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00EB238B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	3_2_00EB25DB
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00EB2704
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00EB28D8
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	3_2_00EB280B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	3_2_00EA92B6
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	3_2_00EA979F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_00EB1FDB
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoW,	3_2_6C9A60F1
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	3_2_6CAE60D3
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	3_2_6CAE6074
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	3_2_6CAE61A8
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	3_2_6CAE61F3
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_6CAE629A
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	3_2_6CAE63A0
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	3_2_6CAE5D86
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	3_2_6CADBD0B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_6CAE5E21
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_6CAE5B35
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	3_2_6CADB6EC

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

Code function: 0_2_00401626 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_00401626

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 3_2_00EAC3FF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

3_2_00EAC3FF

Source: C:\Users\user\Desktop\WiezmDFd6L.exe

Code function: 0_2_00404FAA KiUserCallbackDispatcher,GetVersionExW,GetCommandLineW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,memset,ShellExecuteExW,WaitForSingleObject,CloseHandle,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

0_2_00404FAA

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E8CBF3 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	3_2_00E8CBF3
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E31050 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	3_2_00E31050
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 3_2_00E8D8C9 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	3_2_00E8D8C9

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	14 Windows Service	14 Windows Service	1 Masquerading	21 Input Capture	2 System Time Discovery	Remote Services	21 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	12 Service Execution	1 DLL Side-Loading	11 Process Injection	111 Virtualization/Sandbox Evasion	LSASS Memory	24 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	11 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	36 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WiezmDFd6L.exe	45%	Virustotal		Browse
WiezmDFd6L.exe	47%	ReversingLabs	Win32.Dropper.Vilsel

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	4%	ReversingLabs
C:\Users\Public\Bilite\Axialis\libcurl.dll	61%	ReversingLabs	Win32.Trojan.DllHijack
C:\Users\Public\Bilite\chiomsStup.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://update-xztodolist.cqttech.com/api/v1/update/check?version=3.2.7.32&union=4003&os=10.0.19041.	0%	Avira URL Cloud	safe
http://dump.mgr.xzdesktop.cqttech.com/api/DumpInfoStat%s_%d-%02d-%02d.log	0%	Avira URL Cloud	safe
https://update-xztodolist.cqttech.com/api/v1/update/checkXZDesktopCalendarCXZUpdateModule	0%	Avira URL Cloud	safe
https://update-xztodolist.cqttech.com/api/v1/update/check	0%	Avira URL Cloud	safe
http://dump.mgr.xzdesktop.cqttech.com/api/DumpInfoStat	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dump.mgr.xzdesktop.cqttech.com/api/DumpInfoStat%s_%d-%02d-%02d.log	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, 00000003.00000002.4132139215.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000003.00000000.1722836156.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://crashpad.chromium.org/	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://crashpad.chromium.org/bug/new	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl.google.com/update2/installers/icons/	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://support.google.com/installer/	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://update-xztodolist.cqttech.com/api/v1/update/checkXZDesktopCalendarCXZUpdateModule	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, 00000003.00000002.4132139215.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000003.00000000.1722836156.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://update-xztodolist.cqttech.com/api/v1/update/check	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, RuntimeBrokers.exe, 00000003.00000002.4132139215.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000003.00000000.1722836156.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000003.00000002.4131893924.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://update-xztodolist.cqttech.com/api/v1/update/check?version=3.2.7.32&union=4003&os=10.0.19041.	RuntimeBrokers.exe, 00000003.00000002.4131893924.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://support.google.com/installer/%s?product=%s&error=%d	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.css	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dump.mgr.xzdesktop.cqttech.com/api/DumpInfoStat	RuntimeBrokers.exe	false	Avira URL Cloud: safe	unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.jpg	WiezmDFd6L.exe, 00000000.00000003.1718878797.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580628
Start date and time:	2024-12-25 13:26:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WiezmDFd6L.exe renamed because original name is a hash value
Original Sample Name:	37B0FD9C5E815053E72C20931D2E414C.exe
Detection:	MAL
Classification:	mal48.evad.winEXE@6/9@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 132 Number of non-executed functions: 235
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:27:03	API Interceptor	30884x Sleep call for process: RuntimeBrokers.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Fqae7BLq4m.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Fqae7BLq4m.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Bilite\Axialis\IiViS

Process:	C:\Users\user\Desktop\WiezmDFd6L.exe
File Type:	openssl enc'd data with salted password, base64 encoded
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.851365993588127
Encrypted:	false
SSDEEP:	3:iqktR2INd9IbY:il/NIY
MD5:	AD536A9CDFCA167DE415D847C7579B8A
SHA1:	52405A8B8B8C8734DA13E38C8A9F9A8EA782B8AA
SHA-256:	59213964F6B9A818B94C0DED984E16AAFEE71CE912D88C70747E1CC6AD4D1C78
SHA-512:	F789FC3BF53213146A47BFCBE8D5E0775720189995488F821A928708C809E5D34AAF9869FA056B3251907B4681157D9380D0E9F259F2F0699B50899877B3F315
Malicious:	false
Reputation:	low
Preview:	U2FsdGVkX18JJnI18eSsh/zaQiR5umhCOXeU9e5n2OE=

C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Process:	C:\Users\user\Desktop\WiezmDFd6L.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	777816
Entropy (8bit):	6.621348016864403
Encrypted:	false
SSDEEP:	12288:hEj1aAa/zgWDTuE8jegvwIDMuecTenORuFjBw7oHOSgmskduZnTKVrdMujyE3e+0:ooBCoH3BdoTKxdLyAZXdOEvnBzLRUFgi
MD5:	30A274E00DA842B09E9763F19777ADED
SHA1:	848C6A9348020EAEEC1A5674990683A1D9977B80
SHA-256:	9E65D0E8A1BE49EDE20AD53EE1CF57696C99A28D1B058A185818B58B7FD83F66
SHA-512:	81DED3C48D3FFDCF82952922C4B70D5F0945B1B0D5E178A1B552C7D5E8F39D00D3E007D161A7AFBA4502CC5CB2E92DF973902D94C28DF2DE5176FD2F50DE036A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: Fqae7BLq4m.exe, Detection: malicious, Browse Filename: Fqae7BLq4m.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........a............b......b.......b.................................,.................................................Rich............................PE..L.....Wg.........................................@.................................l.....@..........................................p..0...............X(.......{.. (..p...................0).......(..@............................................text............................... ..`.rdata..............................@..@.data....P.......:..................@....rsrc...0....p.......4..............@..@.reloc...{.......\|...:..............@..B................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Axialis\libcurl.dll

Process:	C:\Users\user\Desktop\WiezmDFd6L.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2290968
Entropy (8bit):	6.6054620256900645
Encrypted:	false
SSDEEP:	49152:AWc2Dj3hktNUysuFDbfes+p9bZuR6c3ne3EQBSeZyWF2:Vc2Dj3hkHRsuFP2s+pvuR6c3nKEQBSeu
MD5:	C257B09BEDDF38B3F89381997852AD36
SHA1:	1CD6B43CBCB0AE1BA1BE52F667F538735E89DFEB
SHA-256:	1618A5C7CEB3AC1B7680616339AD472EDBE3C706023D3DC7891688F40EEEA637
SHA-512:	DC39825D00348D9E421287904F16FEFF0AC29B92C9ACCEF5D2DD270F4A9297F1418BF62A133DCC448386DEBA931BAA14377A3CA03C9254B770EF276A33A731B1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....eg...........!.........<.......!.......................................`#...........@............................0.......h..... ..H............"..)... !..0...........................b......P................................................text...m........................... ..`.rdata..._.......`..................@..@.data...@..... ..^..................@....00cfg........ ......N .............@..@.tls.......... ......P .............@....rsrc....H.... ..H...R .............@..@.reloc...0... !..2.... .............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Axialis\wragbgek.png

Process:	C:\Users\user\Desktop\WiezmDFd6L.exe
File Type:	data
Category:	dropped
Size (bytes):	33724701
Entropy (8bit):	7.999992899770466
Encrypted:	true
SSDEEP:	786432:CJ3OEsZI99fnh9+4RzOqcFWQTUIQUjt1ol9bHoQcq4LliKKG/:3hZIHfhJOnWQTr1olN7qoK1/
MD5:	68A106A46BCD32515D30B56C8ABC29BB
SHA1:	E8EC8977D1DB3152869C46AB630B0B6586C04F71
SHA-256:	10DEEBDC6F75ED88A66BEAEF6AE24D125CCCF14F97E5E03FCE7EA33FBCA37111
SHA-512:	BD5909C2F1904CD416F7BA759939413757D09B06DFF6C37E16B7028EDB114CEDEDE173B7BD8C47C012E38ECA6922E18921453DC79D8CF81B31B13D7CC8FBACBB
Malicious:	false
Reputation:	low
Preview:	..>.....x...@..s..[-.l=jc.\`S..'...;..4Q.U~t...<.WZ...=......J.N....(...th......i(<.W..#..5..`..e.\.....h.U.m..4....R[....i...)M?..ho...u.......l.. ':........#......@..........h.Z..9..(.@i.'.3.}.-...y.y_G.....Yc....;......$,...4.{d+.6C{.........e.I9?j\..P....\...N.9\|4/./.\|..G"g./.u]tt.C....,.H..t.3..../w.....l..\|}N..5y....Db+..>.N...).O......s7.}.NMP.!.!mH..@k"..u2&...D7=........w.x.#...)yy~.6.4".~Y,..x..0..w.......h.(.....)r.a...m.(x.\.>n..<g\.6..C.$...M.PD..B.R.....7........S..Q.......2.qFtz`.Y.M.C.......tF.T....Ud.-....O...............!m...R...0..)....s...U....p.j....+...&q..}!..V..x.lsP....<.8...H .)A3.M...]..bTe.\|....A{..y..._..A....7..>......Jl...<;..e.fT.EoY....}.X....D...7........E.\.S.&].....I..."..u....O>.I......^."...MwS.oN......\>.WC...=a1U.6.d.@i.l.#:..kG.AQ.....z.......F.....n9.$u..\..A..<m....%..Z(..S......F.. ...~....[...G.;L..,;.,.A.D.U...N!..}L....w.2.L.........U!.iiMb..VK......'.T......p......#\|..,....0f?.EO.....r....L

C:\Users\Public\Bilite\chiomsStup.exe

Process:	C:\Users\user\Desktop\WiezmDFd6L.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10384768
Entropy (8bit):	6.780996075213578
Encrypted:	false
SSDEEP:	196608:VpjYZ94Z6AhJ5NtGdDDIauMJZZCgdaTos7s4QA/rmYeus5dvXCKsJdVV3qHDYyY2:VpjwKZF5LGdDDvJZZCgdwbcAheus5xXB
MD5:	C8B07E0F9BA7C97B55CB29835FFAF5F6
SHA1:	9FFFC728C361DCDD4828212F1F0E56A0DAC92463
SHA-256:	A68355D5F7E99F3BE66D84EA5AD4A72F92D1611C53F959C0B4E742B363678578
SHA-512:	0AB0D39F0FBCDB11E241AE95CC540A54EF4D9A6E611AE516EF189627E73505696AEBEDACE7D4527C40F31A021850CB7CB563F4D0CE0411BE2F9B87ABA2493866
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g.........."......T4...i...................@......................................@.........................<.=.U.....=.@.....@..H^..........,...I...`.......k=.....................Pi=......q4.............@.=.l............................text....S4......T4................. ..`.rdata..`....p4......X4.............@..@.data........ >..R....=.............@....tls....u.....?......N>.............@...CPADinfo(.....?......P>.............@...malloc_h......@......R>............. ..`.rsrc....H^...@..H^..T>.............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-25.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	5.131453553888863
Encrypted:	false
SSDEEP:	48:o+g5Ml7wN7hy7rB7MAvgK8HKPpANf985PD:o1dyZAAvgK8HKxANf985b
MD5:	08577C3B1906091F5538E715A8D518DF
SHA1:	57EFB9CC6D5814E65305A9C23B7FB77F4654E9DF
SHA-256:	62481544AD6EA291C5298A54EE5B09D163EB1DC46619586BD2256CE689A868F4
SHA-512:	1D12605C2902ADF14A165384677F9620F2F6A10607C2520B194AF382C630DAD64737C88FB0A00F672C2110F1503FACDAB43C3ED0246E40FFF2CE980D8C96CB08
Malicious:	false
Preview:	[2024-12-25 08:42:22.542] [info] [7436] [application.cpp Run: 51] curl init res:2..[2024-12-25 08:42:22.551] [info] [7436] [application.cpp Run: 64] CreateEvent [780]..[2024-12-25 08:42:22.555] [info] [7436] [application.cpp Run: 76] CXZShellExecute init..[2024-12-25 08:42:22.554] [info] [7436] [application.cpp Run: 78] CXZUpdateModule init..[2024-12-25 08:42:22.554] [info] [7436] [application.cpp Run: 80] Timer init..[2024-12-25 08:42:22.559] [info] [7436] [application.cpp Run: 82] ServiceMgr Run..[2024-12-25 08:42:22.566] [info] [7436] [application.cpp Run: 84] ThreadPoolMgr Run..[2024-12-25 08:42:22.566] [info] [7436] [application.cpp Run: 87] Running m_hWndAsy:263254..[2024-12-25 08:42:22.566] [info] [7436] [application.cpp Run: 107] Message Loop..[2024-12-25 08:42:31.812] [info] [7468] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-25 08:42:34.839] [error] [7468] [mmcurl.cpp Get: 128] curl init failed..[2024-12-25 08:42:38.224] [info] [7468] [xzupd

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-26.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.156104603116801
Encrypted:	false
SSDEEP:	24:oVJzNArWyDVNFW2jVNPWk1ArI7bSS1FW2jbSS1PWvuArqmHquFW2jHquPD:ohAzL8ePxAk3Sg8KSgPJA+U8OPD
MD5:	D5EC5AE6E301FAC243A988D950F30569
SHA1:	11B29E4F2ABEB29697B28E7CAEFB6965FE61A000
SHA-256:	9E4A0784C5846A6FCE317759B30E2CB3BC06F701A9355FC3A9DBF3032A5B334F
SHA-512:	FA461D205B3677DD2372F668CAACEE6D057032B641CE55B0A4927A2701B7920F30E764C3FF725A1949AF36835ED13A6439FDA27809FCE3283EA002881F7B8A24
Malicious:	false
Preview:	[2024-12-26 00:35:59.194] [info] [7480] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-26 01:37:08.492] [error] [7480] [mmcurl.cpp Get: 128] curl init failed..[2024-12-26 02:37:23.900] [info] [7480] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-26 02:37:23.900] [info] [7480] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-26 09:20:22.776] [info] [7488] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-26 10:07:07.745] [error] [7488] [mmcurl.cpp Get: 128] curl init failed..[2024-12-26 11:11:05.467] [info] [7488] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-26 11:11:05.467] [info] [7488] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-26 17:43:39.890] [info] [7496] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-26 18:33:31.277] [error] [7496] [mmcurl.cpp Get: 1

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-27.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	830
Entropy (8bit):	5.135102930583863
Encrypted:	false
SSDEEP:	24:oVlYCArPbsZ/eCFW2j/eCPWh9ArB19FW2j19PD:ob9AfsB8WPgAV82PD
MD5:	4D5C23F9F6D50C1294987663AD584DEE
SHA1:	A4F0CB00E88F99073DC0FE4562601C6079444BE3
SHA-256:	6BF82CA347CF35F164F0B2CCB5339D5B8DF473973AA867156CEEE93D0FF70D90
SHA-512:	DE6819E3882EF0D15BAAF9DBEC747AFF6AC3316019F4802BAF7422EDE6E1D2036B5BF527A21D882363383347128E9B9DE31BEF7C6551DD196A6656AAF2C1F2DD
Malicious:	false
Preview:	[2024-12-27 02:11:03.979] [info] [7504] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-27 03:03:19.245] [error] [7504] [mmcurl.cpp Get: 128] curl init failed..[2024-12-27 03:58:28.367] [info] [7504] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-27 03:58:28.367] [info] [7504] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-27 10:15:02.585] [info] [7512] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-27 10:50:11.014] [error] [7512] [mmcurl.cpp Get: 128] curl init failed..[2024-12-27 11:32:26.376] [info] [7512] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-27 11:32:26.376] [info] [7512] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..

C:\Users\user\Desktop\chiomsStup.exe.lnk

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Dec 25 11:27:01 2024, mtime=Wed Dec 25 11:27:02 2024, atime=Sun Dec 8 12:55:51 2024, length=10384768, window=hide
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	4.686838594335257
Encrypted:	false
SSDEEP:	12:8JqGjUlGIRgCICHqXBCnXIACmqfiXUlX52NUjA68yLfGPNvavzh/kD44t2YZ/ele:8QRGh0BW4NAA6j4NyvFDqyFm
MD5:	E9CD33609A58F29E4B238A7BD92310F4
SHA1:	909E1E5A58DEE223CBE91FB8D91556C42A7AD74C
SHA-256:	B01B8AA3634A52CA9DBE6EC75D5FF798DABA3318818D91DF766DFB1580F64E1B
SHA-512:	3275056321EEB3EC7DE08E1FD77232EAF896B2A2952B23A0F75032B13B926C9F27F6957B9AB2A5BEECD24BF04BEB6E124FDFE80C3E96EA14A2B798BAC24FA146
Malicious:	false
Preview:	L..................F.... ...`..L.V..s..M.V...@.xI...u...........................P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH.Y\c....................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......Y]c..Public..f......O.I.Ybc....+...............<.....U3o.P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....T.1......Yac..Bilite..>......Y]c.Yac..............................B.i.l.i.t.e.....j.2..u...Y.n .CHIOMS~1.EXE..N......Yac.Ybc.........................."e{.c.h.i.o.m.s.S.t.u.p...e.x.e.......T...............-.......S..............-.....C:\Users\Public\Bilite\chiomsStup.exe..".....\.....\.P.u.b.l.i.c.\.B.i.l.i.t.e.\.c.h.i.o.m.s.S.t.u.p...e.x.e..........v..*.cM.jVD.Es.!...`.......X.......045012...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999965747494865
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WiezmDFd6L.exe
File size:	37'394'506 bytes
MD5:	37b0fd9c5e815053e72c20931d2e414c
SHA1:	0dc5769ff9a644e67fe9115fa6158f820a6b39e2
SHA256:	e0cf2976621e7ededbbffb8c8feecc307b73ddaa89d859cb9623bfc972c1f0cc
SHA512:	942828476488658ce86644ea68adea083d34cd176100336c74bc86a1c564d661861934838ff019bbc53cebc3598d0e65d02f35894027f75adc0ee1a0aa7bcc13
SSDEEP:	786432:XlG05eVClWToLBb7rWDCbIlxKjMrCV5cKzMPzTKd/IsiJ7Z:BMAcebXvI3KjMrgTMbTKdPiT
TLSH:	13873369B676E479F3582A3809A04E30F8B88677311647326DB6C49DFBA0F495FD20F1
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................N...............0....@..........................................................................P.............................

File Icon


Icon Hash:	878fd7f3b9353593

Static PE Info

General

Entrypoint:	0x411def
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4C26F87E [Sun Jun 27 07:06:38 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b5a014d7eeb4c2042897567e1288a095

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00414C50h
push 00411F80h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00413184h]
pop ecx
or dword ptr [00419924h], FFFFFFFFh
or dword ptr [00419928h], FFFFFFFFh
call dword ptr [00413188h]
mov ecx, dword ptr [0041791Ch]
mov dword ptr [eax], ecx
call dword ptr [0041318Ch]
mov ecx, dword ptr [00417918h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00413190h]
mov eax, dword ptr [eax]
mov dword ptr [00419920h], eax
call 00007FD701258662h
cmp dword ptr [00417710h], ebx
jne 00007FD70125854Eh
push 00411F78h
call dword ptr [00413194h]
pop ecx
call 00007FD701258634h
push 00417048h
push 00417044h
call 00007FD70125861Fh
mov eax, dword ptr [00417914h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00417910h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041319Ch]
push 00417040h
push 00417000h
call 00007FD7012585ECh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x150dc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x13c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x310	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11317	0x11400	797279c5ab1a163aed1f2a528f9fe3ce	False	0.6174988677536232	data	6.576987441854239	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x30ea	0x3200	1359639b02bcb8f0a8743e6ead1c0030	False	0.43828125	data	5.549434098115495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x292c	0x800	9415c9c8dea3245d6d73c23393e27d8e	False	0.431640625	data	3.6583182363171756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a000	0x13c0	0x1400	5293a0fb2c46166ce21247d17e837639	False	0.3568359375	data	4.96958597460067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a250	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.3709677419354839
RT_ICON	0x1a538	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6081081081081081
RT_MENU	0x1a660	0x4a	data	English	United States	0.8648648648648649
RT_DIALOG	0x1a6ac	0xf2	data	English	United States	0.7148760330578512
RT_STRING	0x1a7a0	0x40	data	English	United States	0.59375
RT_GROUP_ICON	0x1a7e0	0x22	data	English	United States	1.0
RT_VERSION	0x1a804	0x314	data	English	United States	0.44416243654822335
RT_MANIFEST	0x1ab18	0x60f	XML 1.0 document, ASCII text, with CRLF line terminators			0.4229529335912315
RT_MANIFEST	0x1b128	0x298	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4894578313253012

Imports

DLL	Import
COMCTL32.dll
KERNEL32.dll	GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, LoadLibraryA, LockResource, LoadResource, SizeofResource, FindResourceExA, MulDiv, GlobalFree, GlobalAlloc, lstrcmpiA, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, MultiByteToWideChar, GetLocaleInfoW, lstrlenA, lstrcmpiW, GetEnvironmentVariableW, lstrcmpW, GlobalMemoryStatusEx, VirtualAlloc, WideCharToMultiByte, ExpandEnvironmentStringsW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, SetThreadLocale, GetLocalTime, GetSystemTimeAsFileTime, lstrlenW, GetTempPathW, SetEnvironmentVariableW, CloseHandle, CreateFileW, GetDriveTypeW, SetCurrentDirectoryW, GetModuleFileNameW, GetCommandLineW, GetVersionExW, CreateEventW, SetEvent, ResetEvent, InitializeCriticalSection, TerminateThread, ResumeThread, SuspendThread, IsBadReadPtr, LocalFree, lstrcpyW, FormatMessageW, GetSystemDirectoryW, DeleteCriticalSection, GetFileSize, SetFilePointer, ReadFile, SetFileTime, SetEndOfFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleHandleA, SystemTimeToFileTime, GetLastError, CreateThread, WaitForSingleObject, GetExitCodeThread, Sleep, SetLastError, SetFileAttributesW, GetDiskFreeSpaceExW, lstrcatW, ExitProcess, CompareFileTime, GetStartupInfoA
USER32.dll	CharUpperW, EndDialog, DestroyWindow, KillTimer, ReleaseDC, DispatchMessageW, GetMessageW, SetTimer, CreateWindowExW, ScreenToClient, GetWindowRect, wsprintfW, GetParent, GetSystemMenu, EnableMenuItem, EnableWindow, MessageBeep, LoadIconW, LoadImageW, wvsprintfW, IsWindow, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, SetFocus, SetWindowLongW, GetSystemMetrics, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, wsprintfA, SetWindowTextW, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, CopyImage, SendMessageW, GetWindowDC
GDI32.dll	GetCurrentObject, StretchBlt, SetStretchBltMode, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetObjectW, GetDeviceCaps, DeleteObject, CreateFontIndirectW, DeleteDC
SHELL32.dll	SHGetFileInfoW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, SHGetSpecialFolderPathW, ShellExecuteW
ole32.dll	CoInitialize, CreateStreamOnHGlobal, CoCreateInstance
OLEAUT32.dll	VariantClear, OleLoadPicture, SysAllocString
MSVCRT.dll	__set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, memset, _wcsnicmp, strncmp, malloc, memmove, _wtol, memcpy, free, memcmp, _purecall, ??2@YAPAXI@Z, ??3@YAXPAX@Z, _except_handler3, _controlfp

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	07:26:57
Start date:	25/12/2024
Path:	C:\Users\user\Desktop\WiezmDFd6L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WiezmDFd6L.exe"
Imagebase:	0x400000
File size:	37'394'506 bytes
MD5 hash:	37B0FD9C5E815053E72C20931D2E414C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	07:27:03
Start date:	25/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	07:27:03
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	07:27:03
Start date:	25/12/2024
Path:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Imagebase:	0xe30000
File size:	777'816 bytes
MD5 hash:	30A274E00DA842B09E9763F19777ADED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	low
Has exited:	false