Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 22:30
Behavioral task
behavioral1
Sample
ChromeExporter.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ChromeExporter.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target ChromeExporter.exe
- Size 7.7MB
- Sample260717-2e9pgsbx2s
- SHA256 2da182384fa09ac0a1007e75a9b18cf53d324cbc683ede6de27a5ec6788a67d6
- MD5 988adb85d690d9420dd42c4f1c6faff6
- SHA1 4490a37a6deecd4a60a428b6e24c5be9aa9c5423
- SHA512 c19a3114cd8073852548d0c850cf56da10c7f8e2a215ac1c0fd8de072cd697fff42e5fb6b0eeaf77b9ca611f61f7f05c4b4c85c286ecfa6ec41da2b480b98f67
- SSDEEP 196608:ogFmP1W903eV4Q+tpDjIIAcwDIlaUGcRPNavk9SIi:hSW+eGQ69jocBGcXT
- TLSH T128863394E2D89AF4D9B3853E8AD64506EB32B862077CCACB476491533F273C48D7E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 6032 ChromeExporter.exe 6032 ChromeExporter.exe 6032 ChromeExporter.exe 6032 ChromeExporter.exe 6032 ChromeExporter.exe 6032 ChromeExporter.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4904 wrote to memory of 6032 4904 ChromeExporter.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChromeExporter.exe"C:\Users\Admin\AppData\Local\Temp\ChromeExporter.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\ChromeExporter.exe"C:\Users\Admin\AppData\Local\Temp\ChromeExporter.exe"2⤵
- Loads dropped DLL
PID:6032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49042\VCRUNTIME140.dll
- Size 106KB
- SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
- MD5 4585a96cc4eef6aafd5e27ea09147dc6
- SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
- SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
- SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
- TLSH T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49042\_bz2.pyd
- Size 82KB
- SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
- MD5 c7ce973f261f698e3db148ccad057c96
- SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
- SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
- SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
- TLSH T1F2839E93F3A055B5E41BA27699A10357E371FD4A039093EFB348835B2F13B913D6932A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49042\_lzma.pyd
- Size 155KB
- SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
- MD5 4e2239ece266230ecb231b306adde070
- SHA1 e807a078b71c660db10a27315e761872ffd01443
- SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
- SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
- TLSH T14DF33992A394F4E5F7228C78D6624F13D7F678490310929A12CCC36D2B1FB759A2E727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49042\_sqlite3.pyd
- Size 121KB
- SHA256 ff25bdbeef34d2aa420a79d3666c2660e7e3e96259d1f450f1af5268553380ec
- MD5 cee93c920951c1169b615cb6330cedda
- SHA1 ef2abf9f760db2de0bd92afe8766a0b798cf8167
- SHA512 999d324448bb39793e4807432c697f01f8922b0aba4519a21d5dc4f4fc8e9e4737d7e104b205b931af753eda65f61d0c744f12be84446f9c6cb3c2a5b35b773c
- SSDEEP 3072:fZIPlR6TxhNO7/9CO4w5yIFGcXcpVNIGOQyl:RjFHO7kC56cXuo
- TLSH T140C34A67635400AAE9F751B9C4630A17DB75F822537083DF4290C68A1F337C7AE3AB69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49042\base_library.zip
- Size 1.3MB
- SHA256 8d80d3882532a9c88bf2e0572f26fe58ffcc719ebe48f09f33299004cfe97d80
- MD5 5ddb3e8a0b8fee15792fe0e5fbe92e3c
- SHA1 fc1082863d78217a8cf97436c65f3055c706b18b
- SHA512 da2be8c8da19146c7286cfdf78001c52555a697f427d5431078efca51f7b66140af6f9e075c5747f66f56a1a61501006be2541b8255215daa738c977d6365aa7
- SSDEEP 12288:jgCnOmgR1aYcFSgxbHtzJYTq+zYgEkA1qJuAbw0P6dYAwdD9ZttcY+bEMzVCs:j5HC1aYc1ZtJz0P6dYAoTttcY+FCs
- TLSH T11D55D681B692A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49042\python312.dll
- Size 6.6MB
- SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
- MD5 5c5602cda7ab8418420f223366fff5db
- SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
- SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
- SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
- TLSH T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49042\sqlite3.dll
- Size 1.4MB
- SHA256 8aa8b909a39fcc33d1ec2ad51eac6714a318c6efd04f963d21b75d8f64809ad6
- MD5 82ea0259009ff75bba817bd8c15c7588
- SHA1 04c49687d8241b43ae61a6c59299255ef09a7b39
- SHA512 1f8b3343898462e385d25e1820a3d7d971d633933e482ea9ffc596e7e1f902f5657a9f2c104cf320eeef34cce814261304e2e1c063be4c6a807adc9b75f3e670
- SSDEEP 24576:95WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lY8ore60hH:9b0yVKMyjWR6nofQm7U59HWKYY8
- TLSH T12D658D4BB2B800ADC0ABD179C61B571BEBB2740517709BDB55D4CA692F13FE216BE320
- MD5 SHA1 SHA512 SSDEEP TLSH