5693516606e4593095480afa2d0d2f8f7740a73f2789bf0d549fece3dada9d1c

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrome.exe
Size 3.3MB
Sample260822-ndeaasx1cx
SHA256 5693516606e4593095480afa2d0d2f8f7740a73f2789bf0d549fece3dada9d1c
MD5 5801382ae3ce2e897245e9698f641ca8
SHA1 554251df76b0f387e8c288ba01433be7d3ccc896
SHA512 2e56b93ad23b4c3f4b4cb57f6ba5a57259974836c4814ddc896957b255eaf5ad961b6d5ea99d436120a10c9aaa763a57f0152c5bbbb00549c14dc989d1742955
SSDEEP 98304:cvOityjtyH3BfOv62zgotKjYofINcMN0vfgpreyP:zit+tSfG62zgbEVNc5faSC
TLSH
T1FBF5231DD7A844FDE0B7A574CA924C12E73ABC4A4771E78B07D4B8521F732909A3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1940	RenderDocHost.exe

Loads dropped DLL 1 IoCs

pid	Process
1940	RenderDocHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Chrome.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 1940	4664	Chrome.exe	89

C:\Users\Admin\AppData\Local\Temp\Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\RenderDocHost.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RenderDocHost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RenderDocHost.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\RenderDocHost.exe
Size 1.3MB
SHA256 b54ba110eab6bc0490d185fc5b90a24cd88917fee8f01c9daad68bdb001ab26b
MD5 019b4c2969bff71a5aedfb7aeb8d0043
SHA1 dec301bd6ac798759150feb8b9948f9eb3fd38b8
SHA512 37bc03bfb9f20318ecbbdd282cd54f27d2ca7375871c3df2575e518f9d39f5aa4955a8ba31b8c15f1cf72f0e79c25cbf74ece2a7cd638d8b45bd897561ac3bab
SSDEEP 24576:gPQutpm1JmQkRXxhYa2hbajdBwMdizK5UaT7xr:DutpYHkRhh/2h+j7ezqX
TLSH
T1B9554B27B25900F8D0AAC1BDCA49CC95D77174520B20EBDF46D0E7A71F6BAE45EBE201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

renderdoc.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\renderdoc.dll
Size 4.1MB
SHA256 cafb99e2e5ecb77e6aa18d79635ac6cb100956fcb9415801e6c47cd593cb0819
MD5 b3c3ef3db56b0d44a15286fe83146ad2
SHA1 c125465a784cefdc042b02cca27c5e0d24e38873
SHA512 77f4d9163c621681269b27af8d2bbe26ea6d870b134943c7990cc59bb391614cf262b71baecca7fef088bb4c072304a91dfa4f577363d9a551e84bea3a7624e5
SSDEEP 98304:TL4JCH9HYLBbN6pTSPZ0FnXp/KffClRHth+do2cip5RlBo/pvaIZY8fl5gL6w1yx:TL4J84LBb0puh0FZjlgW2LJlu/pyIZYw
TLSH
T1B0169F86E3C49D9BC25DEA35AB04F632D1A2D4628DAF82C64947E7474BB6D120F3CF41
MD5 SHA1 SHA512 SSDEEP TLSH