Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 16:32
General
- Target GoogleCrashHandler.exe
- Size 2.6MB
- Sample260804-t2fe6aal9w
- SHA256 a40089ce1b46ea1f4e2dde23e6090986febe027792c4e4575165d10baca19739
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GoogleCrashHandler.exe"C:\Users\Admin\AppData\Local\Temp\GoogleCrashHandler.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Edge\Core\GoogleCrashHandler.exeC:\Users\Admin\AppData\Roaming\Microsoft\Edge\Core\GoogleCrashHandler.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GoogleCrashHandler.exe
memory/1780-26-0x0000000003090000-0x00000000030FD000-memory.dmp
memory/1780-27-0x0000000073EF2000-0x0000000073EF3000-memory.dmp
memory/1780-29-0x0000000027540000-0x00000000275AE000-memory.dmp
memory/1780-30-0x0000000073EE0000-0x000000007469C000-memory.dmp
memory/1780-31-0x0000000073EE0000-0x000000007469C000-memory.dmp
memory/1780-32-0x0000000073EE0000-0x000000007469C000-memory.dmp
memory/1780-33-0x00000000275B0000-0x00000000275CA000-memory.dmp
memory/1780-34-0x0000000027BD0000-0x0000000027BFC000-memory.dmp
memory/1780-35-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-54-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-52-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-50-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-48-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-46-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-44-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-140-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-42-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-138-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-130-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-128-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-120-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-106-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-90-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-74-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-38-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-40-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-36-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-158-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-156-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-154-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-152-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-150-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-148-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-146-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-144-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-142-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-136-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-134-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-132-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-126-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-124-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-122-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-118-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-116-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-114-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-112-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-110-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-108-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-104-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-102-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-100-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-98-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-96-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-94-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-92-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-89-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-86-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-84-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-82-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-80-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-78-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-76-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-72-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-70-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-68-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-66-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-64-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-62-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-60-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-58-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-56-0x0000000027BD0000-0x0000000027BF6000-memory.dmp
memory/1780-663-0x000000002B9B0000-0x000000002BA16000-memory.dmp
memory/1780-665-0x0000000073EF2000-0x0000000073EF3000-memory.dmp
memory/1780-667-0x0000000073EE0000-0x000000007469C000-memory.dmp
memory/1780-668-0x0000000073EE0000-0x000000007469C000-memory.dmp
memory/1780-672-0x0000000073EE0000-0x000000007469C000-memory.dmp
memory/1780-1308-0x000000002EAE0000-0x000000002EB72000-memory.dmp
memory/1780-1309-0x000000002F140000-0x000000002F6FA000-memory.dmp
memory/1780-1316-0x000000002ED00000-0x000000002EDD2000-memory.dmp
memory/1780-4419-0x000000002E080000-0x000000002E08A000-memory.dmp