IOC Report
RuntimeBroker.exe

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps321010010Label

Files

File Path
Type
Category
Malicious
Download
RuntimeBroker.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\app
Unicode text, UTF-8 (with BOM) text, with no line terminators
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\RuntimeBroker.exe
"C:\Users\user\Desktop\RuntimeBroker.exe"
 malicious
C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\user\Desktop\RuntimeBroker.exe" "RuntimeBroker.exe" ENABLE
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://go.microsoft.
unknown
http://go.microsoft.LinkId=42127
unknown

Domains

Name
IP
Malicious
morning-ultimately.gl.at.ply.gg
147.185.221.26
 malicious

IPs

IP
Domain
Country
Malicious
147.185.221.26
morning-ultimately.gl.at.ply.gg
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
5F2000
unkown
page readonly
 malicious
61C000
heap
page read and write
7B28000
trusted library allocation
page read and write
63F000
heap
page read and write
641D000
stack
page read and write
4C62000
heap
page read and write
650000
heap
page read and write
647000
heap
page read and write
640000
heap
page read and write
5FDD000
stack
page read and write
650000
heap
page read and write
97F000
stack
page read and write
64D000
heap
page read and write
CD7000
heap
page read and write
2BEB000
trusted library allocation
page execute and read and write
600000
heap
page read and write
60A000
heap
page read and write
117F000
stack
page read and write
5D1000
heap
page read and write
655000
heap
page read and write
43E0000
heap
page read and write
11B000
stack
page read and write
2BDA000
trusted library allocation
page execute and read and write
180000
heap
page read and write
65D000
heap
page read and write
2BA2000
trusted library allocation
page execute and read and write
65A000
heap
page read and write
64F000
heap
page read and write
5E3D000
stack
page read and write
565B000
stack
page read and write
5480000
trusted library allocation
page read and write
1A5000
heap
page read and write
7B26000
trusted library allocation
page read and write
61D000
heap
page read and write
643000
heap
page read and write
65E000
heap
page read and write
2BE7000
trusted library allocation
page execute and read and write
7B06000
trusted library allocation
page read and write
4530000
heap
page read and write
61F000
heap
page read and write
107E000
stack
page read and write
5C5000
heap
page read and write
4AAF000
stack
page read and write
623000
heap
page read and write
648000
heap
page read and write
43E6000
trusted library allocation
page read and write
6AE000
heap
page read and write
7B42000
trusted library allocation
page read and write
4AEE000
stack
page read and write
4281000
trusted library allocation
page read and write
651E000
stack
page read and write
7B9B000
trusted library allocation
page read and write
4C7B000
heap
page read and write
A76000
heap
page read and write
5C2000
heap
page read and write
C42000
heap
page read and write
656000
heap
page read and write
648000
heap
page read and write
4EE000
stack
page read and write
42A8000
trusted library allocation
page read and write
61D000
heap
page read and write
64D000
heap
page read and write
535C000
stack
page read and write
4C61000
heap
page read and write
655000
heap
page read and write
647000
heap
page read and write
43AE000
trusted library allocation
page read and write
2BE2000
trusted library allocation
page read and write
60A000
heap
page read and write
63E000
heap
page read and write
4C78000
heap
page read and write
7F080000
trusted library allocation
page execute and read and write
5F9000
heap
page read and write
6A1000
heap
page read and write
641000
heap
page read and write
7BD7000
trusted library allocation
page read and write
656000
heap
page read and write
5D3C000
stack
page read and write
63E000
heap
page read and write
654000
heap
page read and write
647000
heap
page read and write
63DE000
stack
page read and write
760D000
heap
page read and write
52C0000
trusted library allocation
page execute and read and write
4C7C000
heap
page read and write
4C6D000
heap
page read and write
4C62000
heap
page read and write
5E5000
heap
page read and write
CC3000
heap
page read and write
5FC000
heap
page read and write
60A000
heap
page read and write
5F7D000
stack
page read and write
A00000
heap
page read and write
5F0000
unkown
page readonly
64E000
heap
page read and write
C53000
heap
page read and write
3281000
trusted library allocation
page read and write
60A000
heap
page read and write
615B000
stack
page read and write
C7B000
heap
page read and write
5BFD000
stack
page read and write
1180000
heap
page read and write
500000
heap
page read and write
590000
heap
page read and write
61D000
heap
page read and write
643000
heap
page read and write
659000
heap
page read and write
7B8C000
trusted library allocation
page read and write
5E7D000
stack
page read and write
6AC000
heap
page read and write
569C000
stack
page read and write
63F000
heap
page read and write
2BB0000
trusted library allocation
page read and write
647000
heap
page read and write
C92000
heap
page read and write
65E000
heap
page read and write
11F0000
trusted library allocation
page read and write
64D000
heap
page read and write
4C7B000
heap
page read and write
60A000
heap
page read and write
5460000
heap
page read and write
602000
heap
page read and write
69A000
stack
page read and write
2BBA000
trusted library allocation
page execute and read and write
4C70000
heap
page read and write
5F8000
heap
page read and write
5FC000
heap
page read and write
C0B000
heap
page read and write
5BA000
heap
page read and write
61C000
heap
page read and write
5FD000
heap
page read and write
4C69000
heap
page read and write
5FC000
heap
page read and write
1EE000
unkown
page read and write
555C000
stack
page read and write
C27000
heap
page read and write
49AE000
stack
page read and write
C00000
heap
page read and write
1312000
heap
page read and write
643000
heap
page read and write
2BB2000
trusted library allocation
page execute and read and write
4C67000
heap
page read and write
8831000
trusted library allocation
page read and write
641000
heap
page read and write
649000
heap
page read and write
B00000
heap
page read and write
42FF000
trusted library allocation
page read and write
4357000
trusted library allocation
page read and write
60DE000
stack
page read and write
4C78000
heap
page read and write
61D000
heap
page read and write
2BDC000
trusted library allocation
page execute and read and write
E10000
heap
page read and write
2BD0000
trusted library allocation
page read and write
A70000
heap
page read and write
D01000
heap
page read and write
7801000
trusted library allocation
page read and write
7E0000
heap
page read and write
54B0000
trusted library allocation
page execute and read and write
1201000
heap
page read and write
441E000
trusted library allocation
page read and write
2C01000
heap
page execute and read and write
654000
heap
page read and write
2D01000
heap
page read and write
1A0000
heap
page read and write
619E000
stack
page read and write
4C67000
heap
page read and write
5E7000
heap
page read and write
4C78000
heap
page read and write
65C000
heap
page read and write
52F0000
trusted library allocation
page read and write
54A0000
trusted library allocation
page read and write
4BEF000
stack
page read and write
2BAA000
trusted library allocation
page execute and read and write
5CFE000
stack
page read and write
640000
heap
page read and write
655000
heap
page read and write
2BC7000
trusted library allocation
page execute and read and write
608000
heap
page read and write
60A000
heap
page read and write
5F9000
heap
page read and write
545E000
stack
page read and write
5D1000
heap
page read and write
6530000
trusted library allocation
page execute and read and write
65B000
heap
page read and write
4F3000
stack
page read and write
C7D000
heap
page read and write
5FC000
heap
page read and write
652000
heap
page read and write
190000
heap
page read and write
7C0000
heap
page read and write
7B08000
trusted library allocation
page read and write
4C6F000
heap
page read and write
4C78000
heap
page read and write
605000
heap
page read and write
CAF000
heap
page read and write
63F000
heap
page read and write
4C60000
heap
page read and write
65D000
heap
page read and write
6A5000
heap
page read and write
61D000
heap
page read and write
6A6000
heap
page read and write
6AD000
heap
page read and write
64E000
heap
page read and write
11B0000
heap
page read and write
C79000
heap
page read and write
64D000
heap
page read and write
629E000
stack
page read and write
7B82000
trusted library allocation
page read and write
42A0000
heap
page read and write
2E3E000
stack
page read and write
2BCA000
trusted library allocation
page execute and read and write
6A2000
heap
page read and write
60A000
heap
page read and write
5B0000
heap
page read and write
2BD2000
trusted library allocation
page execute and read and write
1301000
heap
page read and write
65E000
heap
page read and write
1190000
heap
page execute and read and write
6AD000
heap
page read and write
65E000
heap
page read and write
611C000
stack
page read and write
641000
heap
page read and write
7929000
trusted library allocation
page read and write
C12000
heap
page read and write
652000
heap
page read and write
87F000
unkown
page read and write
5FB000
heap
page read and write
645000
heap
page read and write
4C79000
heap
page read and write
6A7000
heap
page read and write
7600000
heap
page read and write
7BA2000
trusted library allocation
page read and write
D12000
heap
page read and write
5300000
unclassified section
page read and write
6AB000
heap
page read and write
5FF000
heap
page read and write
CF8000
heap
page read and write
6A9000
heap
page read and write
6600000
heap
page read and write
5F8000
heap
page read and write
CFC000
heap
page read and write
328E000
trusted library allocation
page read and write
5F8000
heap
page read and write
2F3E000
stack
page read and write
7B89000
trusted library allocation
page read and write
4C7A000
heap
page read and write
4FB000
stack
page read and write
4FE000
stack
page read and write
4C41000
heap
page read and write
CB9000
heap
page read and write
2BE0000
trusted library allocation
page read and write
604000
heap
page read and write
7B87000
trusted library allocation
page read and write
5D1000
heap
page read and write
62DD000
stack
page read and write
579C000
stack
page read and write
4C78000
heap
page read and write
4C65000
heap
page read and write
796000
stack
page read and write
EF0000
heap
page read and write
4C40000
heap
page read and write
C77000
heap
page read and write
4C65000
heap
page read and write
A14000
heap
page read and write
55E000
stack
page read and write
There are 256 hidden memdumps, click here to show them.