chromelevator | df13c69b370474edab390f0685fc4986a3a5503035bc907cd66cba3cfc25f892

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
st.exe
Size 14.9MB
Sample260917-cphlbaxfld
SHA256 df13c69b370474edab390f0685fc4986a3a5503035bc907cd66cba3cfc25f892
MD5 f6fefb5c4b60fc99196e6074d8d1d76a
SHA1 f2ee67d878d7cda710c29a049edee3aeb3345627
SHA512 6789259eac892b4d3147eaf37aed61e0198ffe00242e53ded89a716a14f111768759630a53799c5d9065f8eb1e64235c90e64e4b6d7e9386e8993e785277d636
SSDEEP 196608:1WaLHwHGTW1rVTyMH1KXe/ioWGvpqGi56gfjBC47lg8ZrtiDpOe5k5MygEMHMCAw:jUSqks4epWGvV6Llg8KZBsCASfd/
TLSH
T1B1F6229A51D4A67DC480C178E54546F9F0C8BC884CBD992AFFC749127A31CAAC4FAF72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution chromelevator hacktool spyware stealer

Malware Config

Signatures

Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
hacktool chromelevator

Detects ChromElevator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c48a-18.dat	family_chromelevator

Executes dropped EXE 2 IoCs

pid	Process
5260	chromelevator.exe
4452	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
936	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2340	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2812	st.exe
2812	st.exe
936	powershell.exe
936	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2340	2812	st.exe	89
PID 2340 wrote to memory of 4112	2340	cmd.exe	90
PID 2812 wrote to memory of 5260	2812	st.exe	91
PID 5260 wrote to memory of 1956	5260	chromelevator.exe	93
PID 5260 wrote to memory of 1956	5260	chromelevator.exe	93
PID 2812 wrote to memory of 4452	2812	st.exe	96
PID 4452 wrote to memory of 4964	4452	chromelevator.exe	98
PID 4452 wrote to memory of 4964	4452	chromelevator.exe	98
PID 2812 wrote to memory of 936	2812	st.exe	99

C:\Users\Admin\AppData\Local\Temp\st.exe
"C:\Users\Admin\AppData\Local\Temp\st.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 65001 > nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4112
- C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
  "C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" chrome --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Chrome_raw" --kill
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1956
- C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
  "C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" edge --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Edge_raw" --kill
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\Winapi\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\win.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Firefox_Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Firefox_Cookies.txt
Size 31B
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA512 98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
MD5 SHA1 SHA512

Submit Download

Screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Screenshot.bmp
Size 7.9MB
SHA256 68ef00e9622a564f03b617ce25fbc48cbcdcf71e00c2ae24180df03b1611346a
MD5 caafcd05eede9ce86d5a4b924302548b
SHA1 f7b60768b1b612f7ea6a1775b48563f793936fe3
SHA512 13b53b5f5abd280d660c4f3b2845c74a772d5c11d5421c5dd49256ab5c070a97eed94eb0a6e187f499c1b7f1068746db2c80a9969fc37aaa3a2a90d9d1325bbc
SSDEEP 196608:ToTr6hV4o2nj47i5hmQtNE942/TwYyjPHuAkBJ+jICIT8U5qt0JtSpsPlvpbm3kA:ToTr6hV4o2nj47i5hmQtNE942/TwYyjj
TLSH
T162861A697B085C299C3377D06887A1F804280ECDE795C3A8A977AB93FFD1C145EEB191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\System.txt
Size 426B
SHA256 330a132bd7f46c6921d06abb134373a4839aa7932addf9eb0cecd205f2c68423
MD5 30143bb62126bc51289bdca13c76fb12
SHA1 e30f5444756ae06ea3d0f74177d2872b14e64302
SHA512 4868a739acce9e2c49d173acc4bf8140839506c111edc6f171383de561d1e8a05f787ea20a2360402d64f86168a3d685285b4080a4e495f98cb37b5a7fe07483
TLSH
T1C1E0AB18A164E265B03441B203A30F1E61D2B9543AFA1D3194EEA26137C60ACEE8F281
MD5 SHA1 SHA512 TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
Size 1.4MB
SHA256 a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe
MD5 c80f02f86d552c237009ac30499d306a
SHA1 ec380a96795ba9765bdb56fed8a087f406f43e96
SHA512 1b7145b0af0ae5c8c5deee9c7f8243b7aa88bca780e948275be38170e6ab5ec8e417d4cca3ddcafb033816c025c5d046e15a7f7f8a39924ba9d046d8f1a1d8a8
SSDEEP 24576:01Dag/zCuwX9j6f7+rxD6WtcbuERQrSPUPvehdidbqqME:0BhGuwX9j6T+rENuKhdiA7
TLSH
T1F565121AEBA414FDD1B7D534CD624806DBB2F88A07A0A78F13E445965F336A05E3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win.zip

Path C:\Users\Admin\AppData\Local\Temp\win.zip
Size 507KB
SHA256 30e3153800098db2d787ab1d102f65cfecfe91e1300d2351cc925867d3256835
MD5 6cafb290e79c7d89d6c6cd88e06d905a
SHA1 4f6d5f9a38bacf7fce794fa00704e422de8783e2
SHA512 e12d440d9f579cf8058f92c742d2586782d5fa4998ff867d4935d358cefc243bff9a28cb777526b10014f67c68687f9f50b090e0cf85ddd41fe0a249889fb808
SSDEEP 12288:EAIl8mdLnzWli2R8n2J3P+RPE/C2NAJiCoSfoFZ8HnQQoNFiLPG:RazzgxJ3mZ6ZNEiCvAFmHwNFI+
TLSH
T14DB4238839F5BF9ED723157343D74F49E3A3B9223381215EEB43534D4E98ED82A89162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-36-0x000001A2B75D0000-0x000001A2B75DA000-memory.dmp

Download

memory/936-35-0x000001A2CFE80000-0x000001A2CFE92000-memory.dmp

Download

memory/936-34-0x000001A2B75D0000-0x000001A2B75DA000-memory.dmp

Download

memory/936-33-0x000001A2CFDC0000-0x000001A2CFE72000-memory.dmp

Download

memory/936-32-0x000001A2B7700000-0x000001A2B771E000-memory.dmp

Download

memory/936-29-0x000001A2B7550000-0x000001A2B7572000-memory.dmp

Download

memory/2812-2-0x00007FFB60AA0000-0x00007FFB60AA2000-memory.dmp

Download

memory/2812-12-0x00007FF748610000-0x00007FF74A01B000-memory.dmp

Download

memory/2812-7-0x00007FFB5E6B0000-0x00007FFB5E6B2000-memory.dmp

Download

memory/2812-4-0x00007FFB607D0000-0x00007FFB607D2000-memory.dmp

Download

memory/2812-1-0x00007FFB60A90000-0x00007FFB60A92000-memory.dmp

Download

memory/2812-5-0x00007FFB607E0000-0x00007FFB607E2000-memory.dmp

Download

memory/2812-6-0x00007FFB5E6A0000-0x00007FFB5E6A2000-memory.dmp

Download

memory/2812-3-0x00007FFB60AB0000-0x00007FFB60AB2000-memory.dmp

Download

memory/2812-0-0x00007FF7487C4000-0x00007FF749127000-memory.dmp

Download

memory/2812-46-0x00007FF748610000-0x00007FF74A01B000-memory.dmp

Download

memory/2812-47-0x00007FF7487C4000-0x00007FF749127000-memory.dmp

Download