chromelevator | ee8e43b6be1f405fdddb1d5f035734f154a5e23c5476102786bb2329d1f30ad9

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5252.exe
Size 3.3MB
Sample260509-ake9aabw9q
SHA256 ee8e43b6be1f405fdddb1d5f035734f154a5e23c5476102786bb2329d1f30ad9
MD5 2bf1f1e9092b4a535fa4ae2c9fe5c132
SHA1 7cf1d16e1ec3db833dfb944944d3e4a3e1298d6d
SHA512 a532227968177df89b2b9985b5d1de42e6333dec9827ea58d9787e400ae981f077162a4f75c66d206d4882a6678e8e9652f7a817b15896d53d88b97db31f216d
SSDEEP 98304:BOXZ6of21SRag8czOGUMx1bO5HwG1t4VeGvXRZXPt1:4y1Swg8czzx1bO5p740gjXV1
TLSH
T1B3F523162AA40CFDE9774A7ECA674609DAB1BD4247A1EACF43B546864F13BF05D3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution chromelevator hacktool spyware stealer

Malware Config

Signatures

Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
hacktool chromelevator

Detects ChromElevator 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000002a648-10.dat	family_chromelevator
behavioral2/files/0x0004000000025afb-17.dat	family_chromelevator

Executes dropped EXE 3 IoCs

pid	Process
4120	PL298C.tmp
2144	chromelevator.exe
572	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1664	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	powershell.exe
1664	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4120	2956	5252.exe	80
PID 4120 wrote to memory of 3472	4120	PL298C.tmp	81
PID 3472 wrote to memory of 2696	3472	cmd.exe	82
PID 4120 wrote to memory of 2144	4120	PL298C.tmp	83
PID 2144 wrote to memory of 3572	2144	chromelevator.exe	85
PID 2144 wrote to memory of 3572	2144	chromelevator.exe	85
PID 4120 wrote to memory of 572	4120	PL298C.tmp	88
PID 572 wrote to memory of 4996	572	chromelevator.exe	90
PID 572 wrote to memory of 4996	572	chromelevator.exe	90
PID 4120 wrote to memory of 1664	4120	PL298C.tmp	93

C:\Users\Admin\AppData\Local\Temp\5252.exe
"C:\Users\Admin\AppData\Local\Temp\5252.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\PL298C.tmp
  "C:\Users\Admin\AppData\Local\Temp\PL298C.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c chcp 65001 > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2696
- - C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" chrome --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Chrome_raw" --kill
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3572
- - C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" edge --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Edge_raw" --kill
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\Winapi\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\win.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PL298C.tmp

Path C:\Users\Admin\AppData\Local\Temp\PL298C.tmp
Size 3.1MB
SHA256 5158febdd6f34d66385b5fdd30315af46a1576ec65ec515bf55d29867714a998
MD5 ae40997411b572bfedd2905952981ab0
SHA1 ad6b1c521a1b635b7e5f796a9dac7f216160aaf4
SHA512 66d5337dbcc85b75c08cccb9c1f67db152193dbb928fab52973608f353c116dd930b649a8e939ea08601271cdad4de43d0537397d29ff22cbc6497d6d6cda00e
SSDEEP 49152:fHu8lT2+bHY0YDjaGuRuAziBeDOhcr/BhGuwX9j6T+rENuKhdiA7:/XtNb45Djhu5lf2ZrP+diA7
TLSH
T1B7E5C04AE3B400FDD067C178C91A5617EBB2B846037597DF239489A66F23AE15F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chrome_Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Chrome_Cookies.txt
Size 302B
SHA256 39b56c79826df4dc21a419568eed7b331eeb86192da7b57f8604ae3b78713ae5
MD5 4a7181d3b86fa684d69658c30b244d38
SHA1 e5a232792c0aaf5431c21c427621b0614dac271b
SHA512 48fff79dd380b752983011d9323a6cac9608e12e7e2b0f36307f32920810e0cdc6abac70fcf91b44b4065ca0d0ac657ea1ea0e2909318c80beb5a46fa8a350c2
TLSH
T15BE07DE63C03445979A5C8A56105C075FA584D972614BB8290010A14926D740B6E74ED
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Chrome_raw\Chrome\Default\cookies.json
Size 349B
SHA256 2f1da1237761afd0c8ef623752f7809efde19fe8fa635206be44efe30b961708
MD5 c22a6f278bf925ac0ae49ef0715c5202
SHA1 63fd250c591c1119343378fc0abf44453f321339
SHA512 9701b9f1a5c67143adac41fb889767b2ef5759e97fd82708897ce03c7f5057ae861ce99878c6fd237d7285562338191955128200c0085a0503bd62f2e447f4e6
TLSH
T19CE0C0FA78820826EC6294B5680185B8FF685A631114FF83A0140948922870471E38DA
MD5 SHA1 SHA512 TLSH

Submit Download

Edge_Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Edge_Cookies.txt
Size 265B
SHA256 a767864e977a554f6c9d8a159f825622a1fca341ea37c05fe8bd5c26f4f30f9a
MD5 98ed0dc0c80df93ae756f4b7a8431cae
SHA1 76352e6e2b0244d986cfa29315da6b6162e27540
SHA512 482de9218bcf1bc854ca71f71b9d375d479d253b29365d27a03c4ade95c60937b22a69e98fbacae2019903ba6b2bf9e334e45b61ee569f0acd1b69bfd6f0fcf9
TLSH
T17DD02B0531065ADA3585C73A9E7CC2602B30465AE328B19551609436865FB416DE615C
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Edge_raw\Edge\Default\cookies.json
Size 312B
SHA256 ebc1da7e13f2fc85d2015f02313465a114288f06311dad856ea70e078fd05d4c
MD5 5dec52b4854eee3298dafc3b4901bc54
SHA1 007199383d86d228442ad76ac09dd2cdc6b0e4c8
SHA512 1bedbabd2e67c23421d7f8ece5e3f4802fb0848b782956a33bb9c6013e25e46e1b7b66b0b6e77fdce080c145c578894aa3bfcf2a942f7c73b86395cef96230e2
TLSH
T1C2E02D4530860CEAD84183394E38CB443734032BC238B49554B084328A57B0238A388E
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox_Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Firefox_Cookies.txt
Size 31B
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA512 98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
MD5 SHA1 SHA512

Submit Download

Screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Screenshot.bmp
Size 7.9MB
SHA256 48f3d714132db77676c128cee322168bd42dcec4875f02abf7ae8c442757df31
MD5 a0be138a7acb4fc219ebb62975450004
SHA1 be6921438f283cf96dafea04b776ea3dc90cc763
SHA512 518271349d13c6da6596b9d9899a1bb979d52f1eb5141db2abadf056a1f38a953fc7ffeb5aa1c5eaa6eb306280790012fd25dd2c5869feb2a8407e8967efa43c
SSDEEP 196608:f7gVkGRevbNwJpd/q+lLNFy0OOFooyNMOJ2Kyi:f7gVkGRevbNwJpd/q+lLNFy0OOFooyN5
TLSH
T1C686D0E93B086C49C53387F16CC4E2B834280E9DE795C158A9F1EEA3F4E6C539D9B191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\System.txt
Size 430B
SHA256 b63978ce6e4aad0f706fedc8ae78d0bc42a4752eb976c7f49306e2ec475c90e0
MD5 1ff15539e32ee6484bde04fb6fcd12ac
SHA1 3b44785bc557027cc6e3c9fb908e246671dbae3e
SHA512 188b7e7238e96ae8ad8354490290c0c7d05a38e88012c6570fe01ff8f0d253f723db6034b54b20a7c568b6d2731a56119b5d777bb6de0816155acd632c12f024
TLSH
T146E0A3484154E129A03441F303631F4D71D1B95D2AF9593191FEE3503BC945CE9DE581
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2j2kbpvo.aqv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2j2kbpvo.aqv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
Size 1.4MB
SHA256 a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe
MD5 c80f02f86d552c237009ac30499d306a
SHA1 ec380a96795ba9765bdb56fed8a087f406f43e96
SHA512 1b7145b0af0ae5c8c5deee9c7f8243b7aa88bca780e948275be38170e6ab5ec8e417d4cca3ddcafb033816c025c5d046e15a7f7f8a39924ba9d046d8f1a1d8a8
SSDEEP 24576:01Dag/zCuwX9j6f7+rxD6WtcbuERQrSPUPvehdidbqqME:0BhGuwX9j6T+rENuKhdiA7
TLSH
T1F565121AEBA414FDD1B7D534CD624806DBB2F88A07A0A78F13E445965F336A05E3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win.zip

Path C:\Users\Admin\AppData\Local\Temp\win.zip
Size 536KB
SHA256 619d6f7cbbbe87a08e2d5bb9f2d37810237f348b5b55dea02442f5d8fdcd7a2b
MD5 ce7e856c8cb177c5a9f20544ab31b390
SHA1 de0de88f2de07283d7d7910bff2372ea372ecf85
SHA512 f13677ad708fcfb3292adaa5a7a10922ab4a1a8fa46a683f36f5c9ae7d74e581b387b143a7617c170526f3c420658e629de1d7816c8014123b59bb8e4803ed52
SSDEEP 12288:GDLtnfjHa34Ckb2hiGiQ2NvWHnScBNYbXXBAIBwS4YuqFP:gtfjHa3kb2hcQ2FenSkgXBAIC7YuCP
TLSH
T1E8C42344289BD24CDFEF317B128049A85AB473038988A97DF777144DFE66AFC5700A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1664-56-0x0000020248EB0000-0x0000020248ED2000-memory.dmp

Download

memory/1664-68-0x00000202612D0000-0x00000202612DA000-memory.dmp

Download

memory/1664-67-0x00000202613A0000-0x00000202613B2000-memory.dmp

Download

memory/1664-66-0x00000202613B0000-0x00000202613BA000-memory.dmp

Download

memory/1664-65-0x00000202612E0000-0x0000020261393000-memory.dmp

Download

memory/1664-85-0x0000020248E50000-0x0000020248E62000-memory.dmp

Download

memory/1664-64-0x00000202612C0000-0x00000202612DC000-memory.dmp

Download

memory/1664-86-0x00000202612B0000-0x00000202612B8000-memory.dmp

Download

memory/4120-88-0x000002631DDF0000-0x000002631DE9E000-memory.dmp

Download