Analysis
- user interaction
yes - max time kernel
124s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/08/2026, 17:17
General
- Target Install-KAMI 2-GooglePlayGames.exe
- Size 39.4MB
- Sample260815-vtqrlagh46
- SHA256 db8097320abffaad7b97569c84f173f182ee350002dc5a98ef8b6762f1a92030
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 24 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 43 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 4 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install-KAMI 2-GooglePlayGames.exe"C:\Users\Admin\AppData\Local\Temp\Install-KAMI 2-GooglePlayGames.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4i4plhqn.xry\crashpad_handler.exeC:\Users\Admin\AppData\Local\Temp\4i4plhqn.xry\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=26.5.634.0 --initial-client-data=0x558,0x670,0x69c,0x67c,0x6a8,0x7ffd73d9f8a0,0x7ffd73d9f8b0,0x7ffd73d9f8c02⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\dxdiag.log"2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\dxdiag.log"2⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Install-KAMI 2-GooglePlayGames.exe"C:\Users\Admin\AppData\Local\Temp\Install-KAMI 2-GooglePlayGames.exe" -install gpg_install_86f89db5-9780-4557-91fb-f6620430485b "C:\Users\Admin\AppData\Local\Temp\4i4plhqn.xry" 02⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4i4plhqn.xry\crashpad_handler.exeC:\Users\Admin\AppData\Local\Temp\4i4plhqn.xry\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=26.5.634.0 --initial-client-data=0x3c0,0x3c4,0x3c8,0x398,0x3cc,0x7ffd73d9f8a0,0x7ffd73d9f8b0,0x7ffd73d9f8c03⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\4i4plhqn.xry\UpdaterSetup.exe"C:\Users\Admin\AppData\Local\Temp\4i4plhqn.xry\UpdaterSetup.exe" /install "runtime=true&needsadmin=true" /silent3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google4872_2033534458\bin\updater.exe"C:\Program Files (x86)\Google4872_2033534458\bin\updater.exe" --install=runtime=true&needsadmin=true --silent --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=24⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google4872_2033534458\bin\updater.exe"C:\Program Files (x86)\Google4872_2033534458\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x1578584,0x1578590,0x157859c5⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x9d8584,0x9d8590,0x9d859c2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x278,0x27c,0x280,0x274,0x284,0x9d8584,0x9d8590,0x9d859c2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
uninstall.cmd
updater.exe
settings.dat
prefs.json
prefs.json
prefs.json
updater.log
updater.log
updater.log
updater.log
updater.log
updater_history.jsonl
updater_history.jsonl
updater_history.jsonl
updater_history.jsonl
updater_history.jsonl
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
settings.dat
InstallerCrashReporting.log
CrashReporting.dll
UpdaterSetup.exe
crashpad_handler.exe
installer_phenotype_delegate_lib.dll
recorder_delegate_lib.dll
dxdiag.log
dxdiag.log
memory/3352-61-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-63-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-70-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-72-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-68-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-73-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-71-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-69-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-67-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/3352-75-0x0000012BB3630000-0x0000012BB36CC000-memory.dmp
memory/3352-62-0x0000012BB3740000-0x0000012BB3741000-memory.dmp
memory/4004-115-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4004-109-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4004-108-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4004-107-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4004-119-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4004-118-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4004-117-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4004-116-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4004-114-0x000001B7CFFB0000-0x000001B7CFFB1000-memory.dmp
memory/4916-162-0x00000202E6A80000-0x00000202E6A8A000-memory.dmp
memory/4916-163-0x00000202E6B60000-0x00000202E6BD6000-memory.dmp
memory/4916-164-0x00000202E6B20000-0x00000202E6B3E000-memory.dmp
memory/4936-20-0x0000021E1DD50000-0x0000021E1DD76000-memory.dmp
memory/4936-54-0x0000021E1AB00000-0x0000021E1AB10000-memory.dmp
memory/4936-38-0x0000021E1AB00000-0x0000021E1AB10000-memory.dmp
memory/4936-80-0x0000021E80360000-0x0000021E80462000-memory.dmp
memory/4936-39-0x0000021E7FE60000-0x0000021E7FE68000-memory.dmp
memory/4936-37-0x0000021E1AB00000-0x0000021E1AB10000-memory.dmp
memory/4936-21-0x0000021E7FF80000-0x0000021E8003A000-memory.dmp
memory/4936-19-0x0000021E1DD40000-0x0000021E1DD52000-memory.dmp
memory/4936-42-0x0000021E1AB00000-0x0000021E1AB10000-memory.dmp
memory/4936-18-0x0000021E1DCC0000-0x0000021E1DD3A000-memory.dmp
memory/4936-17-0x0000021E1DB10000-0x0000021E1DB18000-memory.dmp
memory/4936-60-0x0000021E80040000-0x0000021E80086000-memory.dmp
memory/4936-15-0x0000021E1DA10000-0x0000021E1DB02000-memory.dmp
memory/4936-16-0x0000021E1AAE0000-0x0000021E1AAF6000-memory.dmp
memory/4936-14-0x0000021E1D790000-0x0000021E1D80E000-memory.dmp
memory/4936-59-0x0000021E801D0000-0x0000021E80356000-memory.dmp
memory/4936-58-0x0000021E24270000-0x0000021E24278000-memory.dmp
memory/4936-57-0x0000021E24240000-0x0000021E2426E000-memory.dmp
memory/4936-56-0x0000021E24220000-0x0000021E24226000-memory.dmp
memory/4936-0-0x0000021E00000000-0x0000021E00916000-memory.dmp
memory/4936-53-0x0000021E1AB00000-0x0000021E1AB10000-memory.dmp
memory/4936-52-0x0000021E1AB00000-0x0000021E1AB10000-memory.dmp
memory/4936-51-0x0000021E1AB00000-0x0000021E1AB10000-memory.dmp
memory/4936-13-0x0000021E1D760000-0x0000021E1D786000-memory.dmp
memory/4936-12-0x0000021E1AAD0000-0x0000021E1AADC000-memory.dmp
memory/4936-10-0x0000021E1AA70000-0x0000021E1AAD0000-memory.dmp
memory/4936-11-0x0000021E1AA50000-0x0000021E1AA60000-memory.dmp
memory/4936-8-0x0000021E1AA30000-0x0000021E1AA38000-memory.dmp
memory/4936-9-0x0000021E1AA40000-0x0000021E1AA4A000-memory.dmp
memory/4936-6-0x0000021E1B060000-0x0000021E1B1E8000-memory.dmp
memory/4936-7-0x0000021E1AA10000-0x0000021E1AA26000-memory.dmp
memory/4936-4-0x0000021E1A9D0000-0x0000021E1A9DA000-memory.dmp
memory/4936-5-0x0000021E1A9E0000-0x0000021E1AA0A000-memory.dmp
memory/4936-3-0x0000021E021E0000-0x0000021E021EA000-memory.dmp
memory/4936-2-0x0000021E1AB10000-0x0000021E1AF62000-memory.dmp
memory/4936-40-0x0000021E7FEC0000-0x0000021E7FEF8000-memory.dmp
memory/4936-41-0x0000021E7FE70000-0x0000021E7FE7E000-memory.dmp
memory/4936-43-0x0000021E23E00000-0x0000021E23E76000-memory.dmp
memory/4936-1-0x0000021E1AB00000-0x0000021E1AB10000-memory.dmp
memory/4936-170-0x0000021E7FF00000-0x0000021E7FF20000-memory.dmp