Analysis
- user interaction
yes - max time kernel
298s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 19:41
General
- Target GUP.exe
- Size 789KB
- Sample260703-yeacvaby2n
- SHA256 b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351
Malware Config
Signatures
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GUP.exe"C:\Users\Admin\AppData\Local\Temp\GUP.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3796-3-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-13-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-17-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-18-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-16-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-20-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-15-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-14-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-11-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-10-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-12-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-9-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-8-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-19-0x000002365B560000-0x000002365B641000-memory.dmp
memory/3796-38-0x000002365B560000-0x000002365B641000-memory.dmp